How NOT to Store Passwords! - Computerphile

What people said

Strong rec noɥʇʎԀʎzɐɹƆ · 2016-07 · Information Security Stack Exchange · on “Securing a private API that's visible on the public Internet”

My analysis: Use HTTPS for all requests. Don't tell anyone the address of the API (I know I probably shouldn't rely on this) Send an access key and a secret key to the API and the API sends back a token that is valid for 1 hour. (Maybe less) You need to activate an HSTS header to truly ensure you're using HTTPS for all requests Security through obscurity. Why not just put a password on it? Note: make sure you store the password securely using bcrypt and a salt. Here's an excellent explanation by Tom Scott. [this video] Anybody can see the URL by opening developer tools and going to requests. Possibly secure, depending on how you implement it. Don't try to implement your own cryptographic suite. I

Recommends Theraot · 2013-11 · Stack Overflow · on “Best practice of Hashing passwords”

Sure SHA1 is more secure that MD5, but for most purposes it is not secure enough. You will probably find useful the video How NOT to Store Passwords by Computerphile [this video] - 9 minutes and 24 seconds long. You must realize that there is much to cover when it comes to authentication and access control, so having a good hashing scheme is not enough. On storing passwords. As you already know, you don't store the password. In fact, when it comes to storing passwords, in general terms you want to store salted hashes of the passwords, using a modern algorithm optimized for this purpose. For the salt it is considered ok to store it alongside to the hash, for the salt value use a random value as lo

Recommends p.s.w.g · 2014-01 · Stack Overflow · on “How to insert bool into database”

For more information, watch Hacking Websites with SQL Injection [LINK] and How NOT to Store Passwords! [this video] for an introductory discussion of these problems.

Recommends scragar · 2014-08 · Stack Overflow · on “I created a login system in php , cannot create Login Failed case”

You're wide open to SQL injection attacks, I suggest using parametised queries, or escaping your variables via: `$escaped_var = $con->escape($var);` - You're also storing passwords in plain text, really bad practice, I suggest watching this video: [this video]

Recommends Marcus Mangelsdorf · 2015-01 · Stack Overflow · on “C# - Securely storing a password locally”

I have to disagree with Brian, because as of now the standard method for storing passwords in any database is to "salt" (see Wikipedia [LINK] for a detailed explanation) the password with a randomly generated value and store the hashed value and the salt in your "database" (see remarks). The salt is not a secret so you can store it in plain text. Whenever the user enters the password you read the salt from your file, apply it to the entered password and then apply your chosen hash algorithm. Then you compare the results with your stored hash. If they match, the user is authenticated. For a good (and entertaining :)) explanation why "just" hashing the password isn't enough, see: How NOT to st

Recommends MisterBla · 2015-01 · Stack Overflow · on “forgot password page in php”

@AshutoshSaboo Maybe this video by Computerphile [this video] will help you a bit. It's about common practices with passwords and how NOT to do it.

Recommends Rajdeep Dosanjh · 2015-01 · Stack Overflow · on “How to pass login credentials to 3rd party site?”

Look into implementing OpenId Connect storing passwords in plain text is a big no no. Take a look at the following [LINK] [this video]

Recommends Andrei Puf · 2015-09 · Stack Overflow · on “How to correctly interpret recursive pseudo code for a hashing scheme”

So basically you are trying to create a salted hash. In order to do that you need just concatenate the password you get from the form with a secure randomly generated salt. The main idea behind is to have different hashes for the same password. If you are a beginner with this kind of stuff take care because it is very easy to get it wrong: [this video]

Recommends Iszi · 2015-10 · Stack Overflow · on “What is the easiest way to encrypt a password when I save it to the registry?”

Tom Scott got it right in his coverage of how (not) to store passwords, on Computerphile. [this video] If you can at all avoid it, do not try to store passwords yourself. Use a separate, pre-established, trustworthy user authentication platform (e.g.: OAuth providers, you company's Active Directory domain, etc.) instead. If you must store passwords, don't follow any of the guidance here. At least, not without also consulting more recent and reputable publications applicable to your language of choice. There's certainly a lot of smart people here, and probably even some good guidance given. But the odds are strong that, by the time you read this, all of the answers here (including this one) will a

Recommends Erik Philips · 2015-10 · Stack Overflow · on “How to properly store password locally”

How to properly store password locally Just don't do it. No really don't do it [this video] . ...But if you really really have to, never just implement it yourself. I would recommend reviewing how ASP.NET Identity hashes passwords [LINK] . Version 3 is pretty rock solid at the moment: note that the following is taken from github.com and may be changed at any time. For the latest, please refer to the previous link. private static byte[] HashPasswordV3(string password, RandomNumberGenerator rng, KeyDerivationPrf prf, int iterCount, int saltSize, int numBytesRequested) { // Produce a version 3 (see comment above) text hash. byte[] salt = new byte[saltSize]; rng.GetBytes(salt); byte[] subkey = KeyDer