Bob Sneidar wrote:
> No I am encrypting the password using the encrypt command before
> storing it in mySQL.
Does the system handle authentication, or is it just storing the
password for some other system?
If the password will be decrypted on the server (as Mark Wieder is
probably typing a reply to this as I'm writing <g>) if the server is
compromised then all of the passwords become compromised along with it.
It seems more common to never store any passwords on a server system,
instead storing only a (preferably salted) hash of the password
(hopefully something stronger than LC's built-in sha1; Mark Smith's lib
contains a function for sha256).
Incoming passwords are then hashed with the same salt to determine a
match to the server store, and discarded from memory once authenticated.
This way if the server is compromised it'll take serious effort to
reproduce the passwords. With sha1 it can take a little as 49 minutes
(see first link below), and with sha256 it may take years.
The downside to this approach is that passwords can only be reset, but
never recovered.
The upside to this approach is that passwords can never be recovered. :)
Whenever I come across a system that lets me recover a password instead
requiring me to reset it, I stop using it immediately.
Scary background on encryption, hashing, and crack times:
<http://www.geek.com/news/researcher-cracks-sha-1-hashes-for-2-10-with-amazons-cloud-service-1295926/>
<https://www.bentasker.co.uk/blog/security/201-why-you-should-be-asking-how-your-passwords-are-stored>
<http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/>
<http://stackoverflow.com/questions/6776050/how-long-to-brute-force-a-salted-sha-512-hash-salt-provided>
PS: There's a request for sha256digest in the RQCC:
<http://quality.runrev.com/show_bug.cgi?id=14223>
--
Richard Gaskin
Fourth World Systems
Software Design and Development for the Desktop, Mobile, and the Web
____________________________________________________________________
[email protected] http://www.FourthWorld.com
_______________________________________________
use-livecode mailing list
[email protected]
Please visit this url to subscribe, unsubscribe and manage your subscription
preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode
