Saturday, August 2, 2008

Storing Passwords securely


The best way to store a password: Salt it then Hash it.

To salt it add random characters to the password entered by the user. Remember we are going to need those random characters later so save them somewhere you can retrieve them later. I would say insert them in fixed locations in the hash. To hash it use the md5 or sha1 function. You can find these functions in the encode ruby extension.

To authenticate the user, you will need to pull the hash associated with the username, retrieve the salt characters, apply them to the password entered by the user, hash it and compare.

Is there a better way?

No comments: