Re: Hidden Application Data

On Sat, 22 Mar 2008 11:28:42 -0700 (PDT), sternr <SternR@xxxxxxxxx>
wrote:

Hey,
I have a commercial application, that needs to store the user's id and
password on the local machine, and we'd like to hide it from our users
(to prevent frauds etc.).

How can I store my application's data in a hidden way?
And don't tell me the obvious solutions: hidden file, registry key
etc. - isn't there a more reliable\hidden way?

Thanks ahead

--sternr
If you must keep things locally then do not store the
username/password but instead store a cryptographic hash of the
username/password. For extra security use some random salt as well.

For a new application you should use SHA-256 as the hash. For
cryptographic salt see
http://en.wikipedia.org/wiki/Salt_(cryptography).

When the user enters their username and password calculate:

hash = SHA-256(username || password || salt) (|| = concatenate)

Store the hash and random salt locally. When the user next enters
their password repeat the calculation and compare the hash values. If
there is a mismatch then do not allow the user access. Each user
should have their own different salt.

Cryptographic hashes are designed so that it is not possible to run
them backwards and deduce the original text from the hash value. The
salt is to make dictionary attacks more difficult.

rossum

.

Relevant Pages

  • Re: Hidden Application Data
    ... The reason I want to hide the user's credentials is not from the user ... If you must keep things locally then do not store the ... For a new application you should use SHA-256 as the hash. ... cryptographic salt seehttp://en.wikipedia.org/wiki/Salt_. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Confused by salt
    ... I hope someone can help clear my confusion. ... time back that used a hash function to store a password. ... advised me that I really ought to use a salt with this in order to add ...
    (sci.crypt)
  • Re: Hashed password secure?
    ... > would be comparing hash values of keyand this hash value would be ... What if I were to salt the password with N bits and *NOT* store the ... second average to check whether a password is correct? ...
    (sci.crypt)
  • Re: Hashed password secure?
    ... ]> would be comparing hash values of keyand this hash value would be ... ]What if I were to salt the password with N bits and *NOT* store the ... ]can store 65,536 numbers in 16 bits). ... ]attacks, the PC would check all 65,536 Salts anyway. ...
    (sci.crypt)
  • Re: bad code, needs work...
    ... > The problem I am getting is checking to see if one field matches the city, ... The outfile opens can be handled in a loop that will at least prevent ... then store that scalar into a hash, which would be a convenient way to ... Again if you store the output handles to a hash, ...
    (perl.beginners)
Quantcast