Databases
StackOverflow2013
Postsdbo
POSafely storing passwords when access to the plaintext is still needed
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSafely storing passwords when access to the plaintext is still needed
    primarykey
    data
    text
    <blockquote> <p><strong>Possible Duplicate:</strong><br> <a href="https://stackoverflow.com/questions/5089841/php-2-way-encryption-i-need-to-store-passwords-that-can-be-retrieved">PHP 2-way encryption: I need to store passwords that can be retrieved</a> </p> </blockquote> <p>I know that the best practice for storing user passwords is to store only an irreversible hash of the password.</p> <p>However, I am developing an application where I will need to store a user's login information for another web service -- I'll need to periodically log them in and perform some maintenance tasks. Unfortunately, the service doesn't offer authorization tokens so I (very apprehensively) have to store the passwords in a way that I can access their plain-text values. I don't own or control the service to which I am authenticating, and the only method is to 'borrow' a users username and password and authenticate.</p> <p>I am planning to AES_ENCRYPT the passwords in the DB, which means that if somebody is somehow able to access the DB they won't be able to get the plaintext. However my code will need to have access to the key to unencrypt them, thus if the entire server is compromised this is no protection and the passwords will be revealed. </p> <p>Aside from the above-described encryption, are there any best practices or steps I can take to do this as safely as possible?</p> <p><strong>EDIT</strong></p> <p>I know that whatever I do, ultimately the passwords must be accessible in plaintext and so a compromised server means the passwords will be revealed, but I am wondering what steps I can do to mitigate my risk. E.G. encrypting the DB protects me in the situation where the DB is compromised but not the entire server. Other similar mitigating steps would be much appreciated.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USCommunity
    1. USJesse Cohen
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTDuplicate
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POSafely storing passwords when access to the plaintext is still needed
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POSafely storing passwords when access to the plaintext is still needed
      1. USSamuel Neff
      1. VTFavorite
    3. VO
      singulars
      1. POSafely storing passwords when access to the plaintext is still needed
      1. This table or related slice is empty.
      1. VTUpMod
    1. COWow... That's a very unfortunate situation!
      singulars
      1. POSafely storing passwords when access to the plaintext is still needed
      1. UScorsiKa
    2. COWhat OS? On Windows there are recommended APIs for storing sensitive data.
      singulars
      1. POSafely storing passwords when access to the plaintext is still needed
      1. USSamuel Neff
    3. COgoing to be stored in a mysql database, running on a CentOS server, code is python, ideally would like something only dependent on python/mysql not OS.
      singulars
      1. POSafely storing passwords when access to the plaintext is still needed
      1. USJesse Cohen
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload