Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Bit late for my answer, but i'll post anyway and i know this doesn't directly answer the question but it is related non the less. Here are a few points about login security.</p> <p><strong>Remember Me</strong></p> <p>You are best to re-hash the hashed password, and store the rehash in the cookie used to automatically log the user in. When you rehash the password, use something specific to the browser as a seed such as the browser type. This will help prevent the cookie being stolen (via people snooping on the network traffic). This helps prevent any chance of using rainbow tables.</p> <p><strong>Sessions</strong></p> <p>Be aware of session hijacking: <a href="http://en.wikipedia.org/wiki/Session_hijacking" rel="nofollow">http://en.wikipedia.org/wiki/Session_hijacking</a></p> <p><strong>CSRF</strong></p> <p>Cross Site Request Forgery - Implemented after you login, but something to be aware of since it only affects logged in members: <a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery" rel="nofollow">http://en.wikipedia.org/wiki/Cross-site_request_forgery</a></p> <p><strong>HTTPS</strong></p> <p>HTTPS should be used on the page the login request is being sent to - it does NOT have to be on the page you are typing your login details on!</p> <p><strong>Hashing</strong></p> <p>You can hash a password client side using javascript which would only server to protect members from having their passwords stolen while transfering them over the network when not using HTTPS. This is good because many people often use the same password for many sites. The disadvantages are: you can't check password length server side &amp; they can't loggin if javascript is disabled (though you can program around that to a degree). Yahoo used to (might still do) do this years ago.</p> <p>When you recieve the password on the server it is often rehashed using a seed and stored in the database. This is more secure as even if people know the hash, they still can't login! Only the original password will rehash to the same hash letting the user login.</p> <p><strong>Keyloggers</strong></p> <p>If you want to get around keyloggers (or most of them) you can do so by adding a JavaScript keypad / keyboard. The user then clicks the letters and numbers to enter their password using the mouse instead of the keyboard meaning the keylogger has a hard time logging the password.</p> <p><strong>Know Something, Has Something, Is Something</strong></p> <p>The three levels of security. Something someone knows such as a password, something someone has such as a phone (google completes these first 2 using 2 step verification), and something someone is such as a finger print. The more of these you fullfill the greater your security credentials are - by a long shot!!!</p> <p><strong>Bots</strong></p> <p>Computers sometimes try to brute force a fast login page (must be fast as if the password is incorrect and the script pauses for even just 1 second, that greatly reduces the total login attempts a bot can make. To help stop this you can either pause an incorrect login for 1 or 2 seconds (like linux does) or you can produce a capture that bots have a hard time solving after X incorrect logins (like google does).</p> <p>There the main points, but i'm sure there are others.</p>
    singulars
    1. This table or related slice is empty.
    1. POPHP Login Script (Secure but not like a bank vault)
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USVBAssassin
    1. USVBAssassin
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload