Storing Passwords Post: 302928974

Sponsored Content

Top Forums Web Development Storing Passwords Post 302928974 by Corona688 on Tuesday 16th of December 2014 03:58:30 PM

12-16-2014

Registered User

Storing Passwords

Yes, it's that minefield again. I'm building an AJAX database interface which uses maria/mysql logins instead of keeping a bunch of its own private logins, to try and keep it simple.

The thorny bit is, of course, the passwords. Doing this requires it to remember passwords between sessions, not merely hashes but reversibly-encrypted passwords. I think I've built something like "ssh-agent" for databases, which keeps a key without leaving it wide-open to the world, but I want your feedback on it.

When the PHP session begins, the server generates a pair of 16-digit strings. One is kept in the server-side PHP session and never given to the user, the other is kept in a client-side cookie and never stored on the server. The concatenation of both strings is used to ENCODE() the password before storing it. It also records and validates your session ID and IP address, so someone can't steal the cookie and pretend to be you. Only the conjunction of a valid cookie with a valid login decrypts a valid password.

It sounds strong enough to me but encryption is not my forte. Are there any giant holes in this scheme?

Last edited by Corona688; 12-16-2014 at 05:04 PM..

Corona688

View Public Profile for Corona688

Visit Corona688's homepage!

Find all posts by Corona688

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Passwords

I am running unix 11.xxx....How do you change a user password. The previous vs was passwd at the command prompt. This no longer works. Thanks for the help

2. Shell Programming and Scripting

Hide Passwords

Is there a way not to display the password in the sys out when your korn shell script logs into sqlplus?

3. UNIX for Dummies Questions & Answers

sqlplus and passwords

Hope I'm in the right place to ask this. ... and I'm a total noob by the way. When changing an account password through telnet, everything seems fine. I can telnet back in afterward, but if I try to use sqlplus to get in it tells me password invalid. If I try to get in through sqlplus with the...

4. AIX

passwords encryption

I want to store a password of a user in a encrypted format and the use that encrypted password in my shell scripting. can any one of you let me know how to do it. Thanks in advance

5. UNIX for Advanced & Expert Users

About unix passwords.

How the unix is maintaining the password ? How it does the encryption and how the passwords are stored in the system and where it is stored ? How it is better when compared to other OS ?

6. OS X (Apple)

Storing ssh passwords/keys in keychain

Can anyone tell me how to set up ssh and keychain so when I connect to the remote system it uses keychain for the password or public key? The remote system is FreeBSD 8.0. Do I need to setup anything else on that end? Cheers.

7. Shell Programming and Scripting

passwords

Dear all, I need to automate/script a user password change process. I'm helpless cannot use expect since it's not installed and cannot install it either. Do i have an alternative. I can store the password in a file and that would be the password that would be set to all the users. If not i don't...

8. UNIX for Advanced & Expert Users

When did UNIX start using encrypted passwords, and not displaying passwords when you type them in?

I've been using various versions of UNIX and Linux since 1993, and I've never run across one that showed your password as you type it in when you log in, or one that stored passwords in plain text rather than encrypted. I'm writing a script for work for a security audit, and two of the...

9. HP-UX

Passwords and shadows

version 11.22 1 - In this version there is the shadow file by default?. If so why when I search the file I get "No / etc / shadow file found"? 2 - What does the "*" in etc / password? at the beginning of each password?

LEARN ABOUT OPENSOLARIS

libgnome-keyring

libgnome-keyring(3)						C Library Functions					       libgnome-keyring(3)

NAME

       libgnome-keyring - gnome keyring library.

DESCRIPTION

       GNOME Keyring is a system to store passwords and other sensitive data in a standardized way across all GNOME applications.

       A  keyring  stores  a collection of encrypted passwords and encrypted information about those passwords. A user can have multiple keyrings,
       each for a different use, but there is a default one, called 'login'. There is also a special 'session' keyring which is not stored on disk
       and goes away when you log out.

       When a user logs into GNOME, the keyrings are locked and a master keyring password has to be provided in order to unlock each of them.

       GNOME  Keyring  includes  an  SSH  agent which integrates with the gnome-keyring and user login for its passwords. It can also use the main
       X.509 private key store.

       GNOME Keyring will set the SSH_AUTH_SOCK environment variable when it starts up.

       The id_rsa and id_dsa files in ~/.ssh are automatically usable through the SSH agent without first 'loading' them. Other X.509 private keys
       marked with the 'ssh-authentication' purpose are also usable.

       Additional SSH keys can be manually loaded and managed via the ssh-add command.

       If  you	use another SSH agent(such as the ssh-agent included with OpenSSH), you may want to disable the SSH agent in GNOME Keyring to pre-
       vent ssh from using it instead of your prefered SSH agent. You can set /apps/gnome-keyring/daemon-components/ssh gconf key to  false.  This
       prevents the SSH component of gnome-keyring from starting up when the user logs in.

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Availability		     |SUNWgnome-libs		   |
       +-----------------------------+-----------------------------+
       |Interface stability	     |Volatile			   |
       +-----------------------------+-----------------------------+

SEE ALSO

       gnome-keyring-daemon(1), attributes(5), gnome-interfaces(5)

       http://library.gnome.org/devel/gnome-keyring/stable/

NOTES

       Written by Jeff Cai, Sun Microsystems Inc., 2008.

SunOS 5.11							    31 Jul 2008 					       libgnome-keyring(3)