-1

I've been researching the methods of securely storing user passwords in a database (by only storing the hashed password, with a strong algorithm, along with a salt, and deriving the key after so many iterations, like pbkdf2). This is great for if my server ever gets hacked and my database stolen. But can't the hacker just change the passwords in the database directly, along with the salt used to generate them?

papiro
  • 159
  • 8
  • 2
    These are very generic questions that belong more in the realm of software architecture, and the answer would be long. As a start, you can build your app to have different DB users, schema's, hashes stored in separate tables/DBs, etc. Most websites just use one DB user for everything, so you can start there. You should also train the developers not to store passwords in their git repo, etc, etc. – Halfgaar Jul 01 '17 at 19:01
  • That's what I was thinking - like the password db on one server, and user information in a db on a different server. – papiro Jul 01 '17 at 19:09
  • 2
    Different servers may be overkill for your application, but yes, Facebook probably does that. – Halfgaar Jul 01 '17 at 19:18
  • 2
    Another reason for protecting the passwords is that a lot of people re-use the same password on multiple sites - so a stolen list of usernames and passwords can be tried on multiple sites and result in break-ins. – Jenny D Jul 02 '17 at 12:42
  • I've updated my question to be more concise. – papiro Jul 03 '17 at 17:26

1 Answers1

1

Try this out it might interest you -

http://privacypolicies.com/blog/stop-hackers/

Oron Zimmer
  • 154
  • 4