user login and passwords

[dee]

Hi
I'm writing a page withing our site that requires logins. Where should the
logins and passwords be kept? SqlServer/Access? Flat files? What are the
options and trade offs?
Thanks.
Dee

 

[Lucas Tam]

I'm writing a page withing our site that requires logins. Where should
the logins and passwords be kept? SqlServer/Access? Flat files? What
are the options and trade offs?

Anywhere you like, but you want want to hash the passwords for security.

SQL Server or Access is probably the best for easy retrieval.

 

[dee]

Thanks for response.
Is hashing recommended even when database is used?

 

[Marina]

Yes, otherwise the administrator of the database, or someone who gains
access to the database can see everyone's password in plain text.

Thanks for response.
Is hashing recommended even when database is used?

 

[tom pester]

Hi Dee,

I really suggest you look into asp.net 2 (I am on a quest to let every living
soul upgrad to v2 so I maybe biased) :

New Security Features in ASP.NET 2.0 http://msdn.microsoft.com/library/en-us/dnvs05/html/SecFeatNT2.asp?frame=true
22/08/2005 15:47:47
Securing ASP.NET Applications - With Less Code http://msdn.microsoft.com/library/en-us/dnvs05/html/aspnet-securingapps.asp?frame=true
22/08/2005 15:46:52
New Membership Features in ASP.NET Whidbey http://msdn.microsoft.com/library/en-us/dnvs05/html/aspnet-membership.asp?frame=true
22/08/2005 15:46:15

If you use v2 then:

- The choice between sql server and access is transparent (access provider
will be available after the official release but I would use sql server (express)
anyway)
- You don't write a single line of code (and as a consequence give the user
more functions like recovery, secret questions,...)
- Your solution is very safe (The passes are salted out of the box. Which
developer did this in the past? My guess is <1%)
- You will feel like an action hero and thus look cooler than your colleagues
(that's why I do it)


Cheers,
Tom Pester

 

[UJ]

When you say 'hash' the variable, what does that mean? I do it all manually
through triggers but is there an easier way?

TIA - Jeffrey.

Yes, otherwise the administrator of the database, or someone who gains
access to the database can see everyone's password in plain text.

 

[tom pester]

http://en.wikipedia.org/wiki/Hash_function

Cheers,
Tom Pester

 

[Marina]

It means encrypt it.

When you say 'hash' the variable, what does that mean? I do it all
manually through triggers but is there an easier way?

TIA - Jeffrey.

 

[dee]

Thanks Tom

Hi Dee,

I really suggest you look into asp.net 2 (I am on a quest to let every
living soul upgrad to v2 so I maybe biased) :

New Security Features in ASP.NET 2.0
http://msdn.microsoft.com/library/en-us/dnvs05/html/SecFeatNT2.asp?frame=true
22/08/2005 15:47:47 Securing ASP.NET Applications - With Less Code
http://msdn.microsoft.com/library/en-us/dnvs05/html/aspnet-securingapps.asp?frame=true
22/08/2005 15:46:52 New Membership Features in ASP.NET Whidbey
http://msdn.microsoft.com/library/en-us/dnvs05/html/aspnet-membership.asp?frame=true
22/08/2005 15:46:15
If you use v2 then:

- The choice between sql server and access is transparent (access provider
will be available after the official release but I would use sql server
(express) anyway)
- You don't write a single line of code (and as a consequence give the
user more functions like recovery, secret questions,...)
- Your solution is very safe (The passes are salted out of the box. Which
developer did this in the past? My guess is <1%)
- You will feel like an action hero and thus look cooler than your
colleagues (that's why I do it)


Cheers,
Tom Pester

 

[dee]

Thanks Marina

Yes, otherwise the administrator of the database, or someone who gains
access to the database can see everyone's password in plain text.

 

[Lucas Tam]

It means encrypt it.

Nope don't confuse hashes with encryption.

Encryption is a 2-way process, you can encrypt and decrypt. Hashes on the
otherhand are not decryptable (once hashed, the original data is lost).