Storing plain text passwords

views:

170

answers:

+1 Q:

Storing plain text passwords

Hi,

I'm working on an AIR application with a web back end. I need to store passwords for other websites (like how some websites do).

What is the best way to store those passwords and transfer them between the PHP back end and the AIR application?

Thanks,

+4 A:

Encrypt them on the back end and only transfer them over SSL protected channels.
Use OpenID

Chris Ballance 2009-06-07 06:16:22

Store them as MD5 hashes in the database.

Midiane 2009-06-07 06:51:36

Not going to do it, as if they're storing usernames and passwords for OTHER sites, then one presumes they are going to log into those sites and thus need the passwords to be retrievable.

blowdart 2009-06-07 06:57:51

? You lost me. You can easily retrieve the passwords by checking the db hash against the posted value (passed into md5())Why I got a -3 rating by just stating normal web practice eludes me.

Midiane 2009-07-10 12:10:03

Can someone please explain why I got -3?!

Midiane 2009-07-10 12:26:08

If possible store the passwords on the users machine and never transfer them to your back end web service. If you choose not to do so then when your server is compromised all those passwords will more than likely be stolen.

Services such as lastpass wish their users to be able to access their passwords no matter what machine they are on so they encrypt and decrypt everything on the user's side and only ever transfer the encrypted passwords to their server. The key which is needed to decrypt the passwords is only ever in the end user's head (or on their machine if they choose to save it) and is never transfered to the server.

Gerry 2009-06-07 09:53:25

Only store them on the client PC, hopefully encrypted, then login using javascript xmlhttprequest.

Rich Bradshaw 2009-06-07 10:33:10

ansaurus

tags:

views:

answers:

Storing plain text passwords

related questions