72
votes
Whats the safest way to store a password in database?
Hashing the salt doesn't really help, because the point of a salt is to be unique, not secret. Using usernames as a salt isn't great either, because the salts should be globally unique, and usernames ...
- 14.7k
44
votes
Accepted
Is it secure to block passwords that are too similar to other employees' old passwords?
A similarity check requires the password to be stored in a recoverable form, either as plaintext or encrypted with a key accessible to the server. Alternatively, the system could store variations of ...
- 17.9k
10
votes
Whats the safest way to store a password in database?
I also read that good practice is that you need to add a nonce to the password-salt-hash and hash that too. This is done so no replay attacks can be carried out.
This seems to be about a login ...
- 33.4k
9
votes
Whats the safest way to store a password in database?
The safest way is to not store the password at all. Where possible use standards like OIDC or OAuth 2.0 to avoid the need for storing a user's password.
If you really need to store passwords, use a ...
- 478
8
votes
Is it secure to block passwords that are too similar to other employees' old passwords?
If “similar” passwords have to be very similar: You take a password and don’t just store its hash, but generate say 500 very similar passwords and store the 500 hashes. Now when I try to create a ...
- 2,613
5
votes
Is it secure to block passwords that are too similar to other employees' old passwords?
This doesn't sound terrible to me but it might come with more negatives than positives depending on your risk assessment.
One good thing is that they can only do this password encryption when the user ...
- 533
4
votes
Is it secure to block passwords that are too similar to other employees' old passwords?
Could there be a way that they can check that passwords aren’t similar at the same time as hashing them, or is this policy flawed?
This question is based the assumption that hashing is the only ...
- 206k
4
votes
Whats the safest way to store a password in database?
This is not secure.
First off, as Sjoerd already pointed out, your question title about storing a password hash is detached from the question text which deals with a password-based authentication ...
- 17.9k
3
votes
Whats the safest way to store 2fa/mfa secret key in database?
You cannot hash the TOTP key, because the key itself is needed for the TOTP calculations. If the server only has a hash of the key, that doesn't help.
Instead, the user-specific TOTP keys should be ...
- 17.9k
2
votes
Is it secure to block passwords that are too similar to other employees' old passwords?
This depends on the company's password-rotation policy.
If the company requires periodic password changes: this is all sorts of bad. It requires storing passwords in a reversible format, letting an ...
- 34.8k
2
votes
Whats the safest way to store 2fa/mfa secret key in database?
Unlike passwords, the server needs to know the actual key for TOTP. Therefore, any kind of one-way hash is unacceptable; you can store TOTP keys under reversible encryption, but not hashed.
However, ...
- 50.4k
2
votes
Why shouldn't I use the OAuth password grant if I have to implement a custom username+password login anyway?
The mistake you're making is that you assume the component which asks for the user credentials is yet another OAuth client, which would indeed lead to a conundrum where one client has to use the ...
- 17.9k
Only top scored, non community-wiki answers of a minimum length are eligible