How to safely store passwords in a database?

Question

I read that one way to store passowrds in a database is as follows. To have a database table with columns, username, hash and salt. Salt will never be shown.

I generate a password hash + salt. The password is sent by the user and is not stored in the database. If the generated hash matches the one stored in the database, the password is correct.

But I have doubts. If I send a password, it will be possible to smell it while it will be transmitted by wire, so I think that it is also necessary to encrypt the message. So using a hash and salt is only protecting data from the administrator? I mean, if I save the password in the database, the administrator can easily access all the information. If I store a hash, administrators cannot access user information, because the administrator does not have half of the information, only salt, not password. However, although the user needs to send a password, it can be sniffed by someone, so the password is revealed.

What is the best way to protect user information?

Thanks.

Answer 1

Hashed passwords also protect your data from strangers. Imagine if someone accessed your data using SQL injection, they would only have a hash, not a pass. You can use HTTPS for secure communication over the network and use the existing hashed password table for a good security model. Secure salty password hashing

Answer 2

If you need to clearly pass the password, you must protect it along the way. From browser to http server, you need SSL / TLS . From the application server to the database, you need encrypted connections .

There are schemes that do not require the transmission of a password; they know HTTP Digest best. You can store the Digest HA1 part in the database. The kingdom secret and username contained in the HA1 digest provide effective protection against rainbow tables , but the fact that Digest is still based on MD5 makes the circuit relatively weak with relatively well-equipped brute force. However, such brute force will only reveal what is characteristic of a given username and region, which makes it very unused.