1

I'm developing a client for an API that doesn't fit the profile for normal clients for this API. This api requires users to be authenticated with a user/password pair or a session key. The session key, however, only lasts as long as the user isn't authenticated elsewhere. It's not feasible to have the user retype the password everytime the session expires. For the moment, while developing the application, I've been storing the passwords in plaintext in MySQL. I would like to avoid this for the production client. How do I secure these passwords when I need them in plaintext to send them to the service?

abartow
  • 51
  • 3
  • Store their hashed form then compare that hash with the database-stored hash? – James Donnelly Jan 22 '14 at 15:11
  • 2
    possible duplicate of [Block ciphers, salt, AES, MySQL, and best practices around credential storage](http://stackoverflow.com/questions/15734892/block-ciphers-salt-aes-mysql-and-best-practices-around-credential-storage) – Brad Jan 22 '14 at 15:12
  • Read the comments on that question I linked to. SLaks suggestion of RSA is much better, and is what I ended up doing in a similar situation. – Brad Jan 22 '14 at 15:14
  • If my database and web server are the same server, are there still advantages to asymmetric encryption? – abartow Jan 22 '14 at 16:58
  • Dupes of http://stackoverflow.com/search?tab=votes&q=%5bphp%5d%20password – Mike B Jan 22 '14 at 17:01

2 Answers2

0

Use database encryption to send and receive sensitive information.

That way, the hacker would also need to have access to the database and figure out the encryption pattern in order to reveal the password. There are software that does it for you such as ProtectDB (http://www.safenet-inc.com/data-protection/database-encryption/protect-db/)

or you can make your own!

RedAces
  • 319
  • 1
  • 3
  • 16
0

Encrypt the password on signup with an hashing algorithm such as SHA512 (http://www.php.net/manual/en/function.hash.php).

Then, when the user logs in with their username and password, encrypt the password, and check it against the stored one in the database.

Tom Whale
  • 1
  • 3
  • This solution does not work in this case (although that's normally what I do when I'm in charge of authentication), because I need to send the plaintext password to a third party to gain access to their part of the system. They do the hash comparison. – abartow Jan 22 '14 at 17:02
  • AH, so you aren't in control of the API? And they require you to send the username in plaintext? The only other way I would look at doing it, is making sure the connection is encrypted (SSL) and sending it plaintext through that tunnel – Tom Whale Jan 22 '14 at 17:09
  • Yeah, the connection to the API is HTTPS, but I have to store the users' passwords so I can send them to the service at any time. I didn't want to just put them in plaintext. – abartow Jan 22 '14 at 17:22
  • Sorry, understand now, couldn't you encrypt the data with a private key and store it, then unencrypt it when required to send? – Tom Whale Jan 24 '14 at 14:26