𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

👨🏻‍💻 tech lead developer 👨🏻‍💻 Never stop learning #webdev #LaravelEnthusiast https://t.co/SbTeXxSNYk currently @flatchr ex @wiztopic Paris, France Joined June 2009

Tweets

1K
Followers

101
Following

446
Likes

149

Alex Xu @alexxubyte

2 years ago

How to store passwords safely in the database and how to validate a password? Let’s take a look. 𝐓𝐡𝐢𝐧𝐠𝐬 𝐍𝐎𝐓 𝐭𝐨 𝐝𝐨 🔹 Storing passwords in plain text is not a good idea because anyone with internal access can see them. 🔹 Storing password hashes directly is not sufficient because it is pruned to precomputation attacks, such as rainbow tables. 🔹 To mitigate precomputation attacks, we salt the passwords. 𝐖𝐡𝐚𝐭 𝐢𝐬 𝐬𝐚𝐥𝐭? According to OWASP guidelines, “a salt is a unique, randomly generated string that is added to each password as part of the hashing process”. 𝐇𝐨𝐰 𝐭𝐨 𝐬𝐭𝐨𝐫𝐞 𝐚 𝐩𝐚𝐬𝐬𝐰𝐨𝐫𝐝 𝐚𝐧𝐝 𝐬𝐚𝐥𝐭? 1️⃣ A salt is not meant to be secret and it can be stored in plain text in the database. It is used to ensure the hash result is unique to each password. 2️⃣ The password can be stored in the database using the following format: 𝘩𝘢𝘴𝘩( 𝘱𝘢𝘴𝘴𝘸𝘰𝘳𝘥 + 𝘴𝘢𝘭𝘵). 𝐇𝐨𝐰 𝐭𝐨 𝐯𝐚𝐥𝐢𝐝𝐚𝐭𝐞 𝐚 𝐩𝐚𝐬𝐬𝐰𝐨𝐫𝐝? To validate a password, it can go through the following process: 1️⃣ A client enters the password. 2️⃣ The system fetches the corresponding salt from the database. 3️⃣ The system appends the salt to the password and hashes it. Let’s call the hashed value H1. 4️⃣ The system compares H1 and H2, where H2 is the hash stored in the database. If they are the same, the password is valid. Over to you: what other mechanisms can we use to ensure password safety? – Subscribe to our weekly newsletter to get a Free System Design PDF (158 pages): bit.ly/3KCnWXq

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

Alex Xu @alexxubyte

Hacking Articles @hackinarticles

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

Tobias_Petry.sql @tobias_petry

Wes Bos @wesbos

Addy Osmani @addyosmani

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

🐴 Frontend Horse @FrontendHorse

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

Edward Snowden @Snowden

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

𝙰𝚗𝚝𝚑𝚘𝚗𝚢 ⚡ @Toussinours

Nicolas Guyon - e/acc @nico16184

vicky parenteau @vivi324

Maître Mô - Théât... @MaitreMo_show

Xavier Ripart @xripart

Axel Tech - Lead Dev ... @AxelTechTV

Touneeteight @touneeteig43640

Efrain @Shethes159647

Ludovic CADENET @LudovicCad33025

Guillaume HULIN @guillaumehulin

Pierre Ammeloot @Pierre_A

EXTIA @Extia_conseil

Communautés Métiers... @CometByExtia

Anthony @tonylyjones

Emrys Emrys @EmrysEmrys3

Romane Sgn @seguin_romane

Elhadji Massamba Dien... @ElhadjMassamba3

Najeebullah payman @Najeebpayman1

Boost Note @Boostnoteapp

𝕄illy @mbbillz

Ari Bajo @ari_bajo

4nn13 @4nn131

Pervez @jony_790

Forgotten Places @ForgottenPlce

Naveed @naveedjb

📷 Greg l'Héritier... @gllens_art

Mildoscientos @Mildoscientos1

talent.io @talent_io

Wiwi @WiwiAH

Nada @NadaWael_94

Perigault Chrystel @PerigaultC

Angular Top 5 @5Angular

Cercle éco WK85 @CercleWK85

Carolyn O. @carolyn_oo

cb @celineBouleau

Atenaweb @Atenaweb

Sam @robin21galland

Navitia @navitia

PwaParis @PwaParis

PHP Development @phpdv

florian @florian41842313

Guiraodamien @Guiraodamien1

AngularJS @AngularJS_Two

TALENDERS @Talenders

Audrey Lamy @Audrey__Lamy

Manon COCAGNE @M_COCAGNE

Hire Me Australia @hiremeau

Richard Pauline @paulinecpm

Mathilde Depollier @_MathildeDepo

Maître Pandavocate @Pandavocate

Charlène Cardoso �... @CharleneCardos0

iroy @iroytoutcourt

PlayStation Park @PlayStationPark

AI Edge @aiedge_

ClaudeDevs @ClaudeDevs

jean-claw le homard @jeanclaw_

Ragnar Le Breton OF C... @Ragnarlebreton

Mila ✨ @milafique

Obsolete Sony @ObsoleteSony