ANY password stored in any way is not 100% secure, but for reversible - which is the only way for me for my particular case - what are the best options?
I don't talk / ask about whether it's secure to store like that or not.
I want to avoid storing the password in plaintext.
Currently working as a contractor, mostly on Node.js and Typescript, also React.
Also have a background in academia, I have a PhD in CS and worked as a researcher in AI.
Em, we seems to be talking about different things.
I don't need to decrypt passwords stored by someone else.
My users will enter their password in my app. I need to store that info in DB and then reuse later but decrypted. I can select any algo to crypt. I want to get insights of how to better do that, so at least it won't be too obvious to decrypt by someone else having access to DB.
This app is open sourced, so definitely, some salt should be used (and they are unique for all users on their sites).
Currently working as a contractor, mostly on Node.js and Typescript, also React.
Also have a background in academia, I have a PhD in CS and worked as a researcher in AI.
No, the article is good, you just can't understand my use case. Seems I'm too vague, sorry. But I can't go into more details, will try to find answers elsewhere.
Reset passwords is just marking the password as deprecated and ask a user to change it without decryption (and resave the hashed value in DB). And I must decrypt and be able to [password => hashed in DB => password].
Currently working as a contractor, mostly on Node.js and Typescript, also React.
Also have a background in academia, I have a PhD in CS and worked as a researcher in AI.
Slava's asking how to securely store the user's password so that his app can then talk to another app as if it were that user. On that user's behalf.
Because the other app needs the user's password, he needs some way to store and retrieve the user's password.
It's tangential to the discussion here.
Slava, you need to look to see if this "other app" has some other way to allow users to delegate access. This is where OpenID and OAuth, etc., come in.
I use OAuth2 when possible, but it's not always the case. I have to support this old-school insecure way, so trying to be less evil by searching the way to improve the password storage.
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
I know that, of course.
ANY password stored in any way is not 100% secure, but for reversible - which is the only way for me for my particular case - what are the best options?
I don't talk / ask about whether it's secure to store like that or not.
I want to avoid storing the password in plaintext.
I suppose when you say reversible you mean they are encrypted. Do you know which algorithm was used?
Em, we seems to be talking about different things.
I don't need to decrypt passwords stored by someone else.
My users will enter their password in my app. I need to store that info in DB and then reuse later but decrypted. I can select any algo to crypt. I want to get insights of how to better do that, so at least it won't be too obvious to decrypt by someone else having access to DB.
This app is open sourced, so definitely, some salt should be used (and they are unique for all users on their sites).
You should look up how the password reset functionality works, that way there's no need to ever recover passwords in plain text.
Have you read the article? I was hoping this would be something that was clear after reading it, if not then I clearly failed.
No, the article is good, you just can't understand my use case. Seems I'm too vague, sorry. But I can't go into more details, will try to find answers elsewhere.
Reset passwords is just marking the password as deprecated and ask a user to change it without decryption (and resave the hashed value in DB). And I must decrypt and be able to [password => hashed in DB => password].
That's not how hashes work.
Anyway if you have time I recommend reading how password storage is done in ASP.NET Identity. Looking at a concrete example might help.
Slava's asking how to securely store the user's password so that his app can then talk to another app as if it were that user. On that user's behalf.
Because the other app needs the user's password, he needs some way to store and retrieve the user's password.
It's tangential to the discussion here.
Slava, you need to look to see if this "other app" has some other way to allow users to delegate access. This is where OpenID and OAuth, etc., come in.
I use OAuth2 when possible, but it's not always the case. I have to support this old-school insecure way, so trying to be less evil by searching the way to improve the password storage.