How do the most basic password security to the server.

Do app do site，Inevitably and server、Backstage、Data deal，Then developed as a background，When it comes to Register Login，You should think most users should be safe，In particular password security。

Now a website security community almost every day、A company is Tuoku，That is the whole point of being stolen database download。So all your user data fall into the hands of criminals，Even so should be how to prevent，Criminals can not get the real password of the user of it?

Here we define，"Can not get" refers to the "lifetime" He can not get，Theoretically, if there is sufficient time (such as 1000, 0000) then any password can always decrypt，So if a encryption program for hundreds of years can not be counted in today's existing count out the premise of force，Then we believe that encryption is secure；"Real Password" Here we do not mean that the user enters the password，But the string can be used to log on our website (if you really save a user's plaintext password ...... it is really a plaintext)。

Communications Security

This is the biggest prerequisite，Otherwise, anyone can obtain communication between the user and the server，Then you do a very difficult security，The most basic one to use HTTPS，If the pursuit of high-quality，It can issue its own certificate。

Message Digest MD5 SHA1

This should be the most familiar hash algorithm，They are widely used database password security field - of course，There are hackers password cracking dictionary、Rainbow tables, etc.。Once your database leak，If you directly to a user's password md5 or sha1，thatAlmost identicalThe plain text。

Fixed salt

Salted hash before the password is common practice security industry，Summary information to the user before doing，To join the specific content，Then together make a hash，So you get a different hash string，It seems very nice，But note，Your salt is fixed(Or how to compare user next logs?)，Then the hacker to get your database(Or even reverse, etc. You get the salt)，You still encryptedEquivalent to a certain extentPlaintext - because hackers can easily be generated based on your salt make a new dictionary。

The user is not credible

Whether it is website development，Or the development of mobile applications，Keep in mind that this title in my heart always - the user is not credible。We can not put his knees up or folded hands praying users are virtuous saints，So you simply do encryption on the client side，It is totally inadequate to protect the user's safety。Other，Even if you are well protected，Then the man in the middle attack? and so，We must ensure，All the necessary cryptographic operations，To be achieved in the service side，The client can be a simple encrypted to prevent the user's cleartext password being stolen during transmission，But this simple encryption must not be deposited directly into the database。

Real password salt

So in the end how to do in order to achieve the necessary，Or security industry norms do? The first is suitable digest algorithm，MD5 or SHA1 outdated，Use safer SHA256 Encrypt。

Then select the encryption algorithm，What do the encryption? Encrypting a user's password is generated in real time and in our server random salt b，即 a+b

What this benefit is it? Users a and b are weak passwords using 123 As their passwords，So if you just hash，There is no doubt that the resulting string is the same，Analyzing a hacker at least two users can directly use the same password。If you add a randomly generated string，So even if two users use the same password，It will be stored in the database completely different string，This ensures that when hackers stealing your database，He fully targeted weak password can not determine who is consistent in order to crack passwords。

but，This is safe，Then the above said，Next time the user logs on，And how can I determine the user-entered password correct? After all, when you create is random，You can not always retrieve your password now!

So，You can not throw the salt，It was also present in the database，When the user enters the password，You should password and salt merger，Then compute the hash，The obtained results and password in the database comparison，If agreement，It shows that the password is correct it! Simultaneously，If a hacker got your database，They still can not get the real user password，Get is a bunch of completely repeatable and completely random password hash salt。

Too short and without nothing different salt

Your random string is too short，That is basically the same and no，Use random salt a little longer more meaningful，Other，Do you use the code provided the basic frameworkordinaryPseudo-random number generator，Those random number is not prepared to password security，Should use special randomly generated，For example, in Python the.urandom(n) Use of specific methods：

Expansibility

Do not think this call it a day，Your best encryption but also the way into the database corresponding to the user，So easy in the future if you do encryption upgrade(SHA256 there are always overdue day)，Then you can still be compatible with the old and new at the same time，And will not immediately force all users to change passwords。

Summary

In short，By the real password hash with salt，You get industry-standard safety requirements，of course，The hash algorithm also determines the level of security on your fundamental。This is just the most basic security as a server of a ring，For example, all your data should be submitted signed，User login should get a token to authenticate each time instead of the local save the user's account password using token ......

Want to know more about password salt，Venue：Proper use salted password hashes[Interpret]

Original article written by Gerber drop-off：R0uter's Blog » How do the most basic password security to the server.

Reproduced Please keep the source and description link：https://www.logcg.com/archives/2759.html