Re: Secure password storing

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Frank Eller [MVP] (feNOSPAM_at_frankeller.de)
Date: 06/05/04 

Date: Sat, 5 Jun 2004 16:47:09 +0200

Hi Gordon,

>
> In my application I need to store a password the user enters
> (unfortunately not a hash of it, but the password as a plaintext
> string).

Why not the Hash ...? That's the safest way ...

>Is there any secure way to do so (by Visual Basic .NET)?

The only way to store something securely is to encrypt it. You can never
save a password as plain text and be on the secure site. But there'S
possiblilities in .NET to encrypt and decrypt passwords (encrypt it before
it is stored, decrypt it before you check it ...). Looak at the
System.Security.Cryptography namespace.

Regards,

Frank Eller
www.frankeller.de

> Thanks
> Gordon

Relevant Pages

  • Re: 2 Keys decrypts same message
    ... > Hash of the Password (hash the pwd, ecnrypt it and then store it) ... > The idea is to use DES to encrypt the password using the password as ...
    (sci.crypt)
  • X509Certificate hell!
    ... a hash must be generated and signed. ... Encrypt the connection string and store this in the Windows registry in a binary value using the certificate public key. ...
    (microsoft.public.dotnet.security)
  • Re: Putting passwords in a properties file?
    ... I suppose I could encrypt with something and hardcode that encryption ... are checked when the users log on; for that purpose using a hash would ... store the hash of the password in the file or database. ...
    (comp.lang.java.programmer)
  • Re: Password hashing question...
    ... there is no way to to securly store date your program has to read. ... only can try to divide the information neede to restore the data. ... E.g. if you encrypt the password, the programm will need the key to encrypt ... A hash is a one-way conversion. ...
    (microsoft.public.dotnet.languages.csharp)
  • RE: Can Kerberos be cracked??
    ... Subject: Can Kerberos be cracked?? ... If you were able to decrypt the timestamp ... As for your assumption about the hash being as good as the password, ... > encrypt the timestamp) still be susceptible to brute-force> using dictionary ...
    (Focus-Microsoft)