Advertisement
Help Keep Boards Alive. Support us by going ad free today. See here: https://subscriptions.boards.ie/.
If we do not hit our goal we will be forced to close the site.

Current status: https://keepboardsalive.com/

Annual subs are best for most impact. If you are still undecided on going Ad Free - you can also donate using the Paypal Donate option. All contribution helps. Thank you.
https://www.boards.ie/group/1878-subscribers-forum

Private Group for paid up members of Boards.ie. Join the club.

Storing passwords in sql server

  • 31-05-2007 03:18PM
    #1
    grahamor
    Registered Users, Registered Users 2 Posts: 872 ✭✭✭


    Hi,

    Im creating a small app that will enable the user to login once their account has been created. If they have forgotten their password they will be able to get it sent to their email address.

    What is the best way to store a password in a db ?

    If i hash the password will i be able to email it to the user if they forget it ?

    What about encryption, is this easy to implement ?

    Thanks


Comments

  • #2
    aidan_walsh
    Closed Accounts Posts: 17,208 ✭✭✭✭aidan_walsh


    grahamor wrote:
    If i hash the password will i be able to email it to the user if they forget it ?
    No. But passwords should never be sent by email anyway.

    What you should do in the case of a forgotten password is point the user to a form that allows them to change the password. You will needs to take additional details in order to verify that it is the user in question - the infamous "secret question". This has the inenviable job of being secret enough that nobody but the user will be able to answer it, but not so difficult that the user will forget. You'll have a fun time trying to pick that one...


  • #3
    matrim
    Registered Users, Registered Users 2 Posts: 7,516 ✭✭✭matrim


    If you are using SQL Server 2005, it has built in encryption using 3DES (I think).

    If it's SQL server 2000 you need to get a third party app or do it yourself before storing the password.


  • #4
    8k2q1gfcz9s5d4
    Closed Accounts Posts: 2,616 ✭✭✭8k2q1gfcz9s5d4


    MD5 hashing would be ok to use, if it is a small enough app


  • #5
    Webmonkey
    Registered Users, Registered Users 2 Posts: 9,579 ✭✭✭Webmonkey


    Message Digest is one way encryption so once encrpyted it cannot be decrypted - hense the server cannot email out the password.

    What should be done like Aiden said is a secret question and once they answer this correctly, they get to change their password.

    Of course you could get the server to change the password and send out the non encrypted version to the user by email but that wouldn't be the recommended way.


Advertisement