david wheeler dwheeleridaorg need store database password clearly first step store text outside web tree encrypt store encryption key elsewhere least attacker get two different things also dont get full privileges create user account granted limited access however often better security critical create separate program database keys noted make web program contact create limited protocol lets operations need add specific operations later theres performance hit youre trading improved data isolation giorgio zoppi wrote fri aug 23 2002 david wheeler wrote standard way store passwords store passwords instead store salted hash password database get purported password resalt compute hash determine unix done years want bigger hashes salts old unix systems still want prevent reading files foil password crackers info book httpwwwdwheelercomsecureprograms wellbut applied database password web apps use solution figure store clear outside web tree ideas feasible ciao giorgio never forever denebpenguinit homepage httpwwwclidiunipiitzoppiindexhtml david wheeler dwheeleridaorg fri 30 aug 2002 102913 0400 storing passwords