DEV Community

Things you wanted to know about storing passwords but were afraid to ask

Rui Figueiredo on December 04, 2017

Security breaches are very common. To make matters worse, when it comes to users' passwords it is frequent that no reasonable precautions were take...
Collapse
 
slaffik profile image
Slava Abakumov

And any recommendations/things to read about reversible passwords storing? When the password is absolutely needed to be accessed in plaintext when using it. So the flow: user enters a password, encrypt it (don't really care about timing here), store in DB, when needed - retrieve from DB, decrypt and send to a 3rd party service in plaintext. I know that this is bad, but there are no workarounds.

Collapse
 
ruidfigueiredo profile image
Rui Figueiredo • Edited

If the passwords are stored correctly, and the password you are trying to retrieve is a "good" password, what you are trying to do should be impossible to achieve in any reasonable amount of time.

Collapse
 
slaffik profile image
Slava Abakumov

I try to store (more or less) securely the password but in a reversible way. Are you referring to this case?

Thread Thread
 
ruidfigueiredo profile image
Rui Figueiredo

If it's reversible by you it means it is reversible by someone else, therefore it's not secure.

Thread Thread
 
slaffik profile image
Slava Abakumov • Edited

I know that, of course.

ANY password stored in any way is not 100% secure, but for reversible - which is the only way for me for my particular case - what are the best options?

I don't talk / ask about whether it's secure to store like that or not.
I want to avoid storing the password in plaintext.

Thread Thread
 
ruidfigueiredo profile image
Rui Figueiredo

I suppose when you say reversible you mean they are encrypted. Do you know which algorithm was used?

Collapse
 
crongm profile image
Carlos Garcia ★

I've seen/read somewhere else about adding "salt" to passwords for storage, but never as clearly explained and with use cases as in your article. Thank you.