👋 Hello everyone,

As we welcome the new year, I would like to share an approach to securely store and protect user passwords. I'm sure many of you have wondered about the best practices for storing usernames and passwords in a database and the potential risks if they were to be leaked.
Let's explore this topic together and find effective solutions to ensure the security of user credentials.

Whether you are already familiar with this topic or not, this post serves as a helpful reference.

The best practice to store passwords in the database

Let's consider a scenario where you've been assigned a new task to implement a user onboarding feature, which includes functionalities like login and logout. As part of the login flow, it is essential to have a table to securely store user credentials.

Store password as plaintext

This approach is simple but highly discouraged. It involves saving passwords as plain text in the database. However, it is crucial to understand that this is the worst approach for storing passwords. If anyone gains access to your database, they will have visibility into all user passwords, which poses a significant security risk if data is leaked.

Store password as hashed text

A more secure approach is to store passwords as hashed text. In this method, the original password is transformed using a one-way hash function before being stored in the database. When a user signs in, their entered password is hashed and compared to the stored hashed value. If they match, the user is granted access .

While storing passwords as hashed text provides an extra layer of security, it's important to note that it only prevents the direct visibility of the original password. However, it does not protect against attacks like rainbow table attacks, where precomputed hash values are used to crack passwords

Generate a unique and random salt

To strengthen password security, it is recommended to implement additional measures such as salting. Salting involves adding a unique random value to each password before hashing, making it significantly more difficult for attackers to crack passwords using precomputed tables.

One common approach is to generate a unique ID for each user before storing their password. This unique ID is then combined with the user's original password and hashed. By incorporating this unique ID, even if two users have the same password, their hashed values will differ due to the individual salt values

Figure 1.How to store a password in database?

Referring to the image above, the password is hashed using the MD5 algorithm with a combination of the original password and a unique ID.

For example, the formula md5(original password | unique_id) => md5("luciango123456|gsfWBPfSPX").

However, it's important to note that MD5 is considered a weak algorithm for password hashing and should be avoided for security reasons. To enhance the security of password storage, it is recommended to use stronger algorithms such as SHA-256, SHA-3, bcrypt, or other secure hashing algorithms. These algorithms provide better resistance against various attacks, including rainbow table attacks.

Other effective methods to mitigate the risk of attacks

To mitigate the risk of attacks, there are several effective methods you can employ, including:

• Rate Limiting : By implementing rate limiting, you can restrict the number of requests that can be sent within a short time frame. This prevents attackers from overwhelming the system with multiple requests, helping to safeguard against brute force attacks.
• CAPTCHA: CAPTCHA serves as an additional layer of protection by distinguishing between human users and automated bots. Users are required to complete a challenge, such as solving a puzzle or entering distorted characters, before proceeding. This ensures that only genuine users can continue while deterring automated attacks.
• Account Lockout: An effective measure involves temporarily locking an account after a certain number of unsuccessful login attempts. By doing so, you protect against brute force attacks and unauthorized access by preventing further login attempts for a specific duration

---

Off-topic discussion

Why use hashing instead of encryption or encoding?

When it comes to storing passwords in a database, it is generally recommended to use hashing instead of encryption or encoding. Here's why:

• Encryption is a reversible process that uses a key to convert data into an unreadable format, which can be decrypted back into its original form.
• While encryption can be used to protect sensitive data, it is not suitable for storing passwords because the encryption key could potentially be compromised, allowing attackers to decrypt the passwords.
• Encoding, such as base64 or hexadecimal encoding, is a process that represents data in a different format but does not provide any security. It is not designed for password storage.

In summary, hashing is the preferred method for storing passwords in a database because it provides a higher level of security compared to encryption or encoding. Hashing ensures that even if the database is compromised, the original passwords remain protected.

How rainbow table attack works?

A rainbow table attack is a method used by attackers to crack password hashes. Here's a brief explanation of how it works:

1. Creating a table: The attacker first creates a table of precomputed hash values for a large set of possible passwords. This table is known as a rainbow table.

2. Obtaining the Hashes: The attacker gains access to a database or system that stores password hashes. These hashes are typically generated from the original passwords using a one-way hash function.

3. Comparing Hashes: The attacker compares the stolen password hashes with the entries in the rainbow table. If a match is found, it means the original password has been discovered.

4. Revealing the passwords: Once a match is found, the attacker can retrieve the corresponding plaintext password from the rainbow table, revealing the original password.

Rainbow table attacks are effective because they eliminate the need for the attacker to calculate the hash values for each possible password individually. Instead, they can quickly search the precomputed table for matches, significantly reducing the time and effort required to crack passwords.

---

Conclusion

By implementing these recommended measures, you can greatly enhance the security of your password storage system and effectively mitigate the risk of unauthorized access.

Moreover, in today's technological landscape, there are alternative methods available for user authentication that go beyond traditional username/password combinations. These methods include :

• Single Sign-On (SSO), which allows users to access multiple systems and applications with a single set of credentials, thereby simplifying the login process.
• Additionally, the use of two-factor authentication (2FA) adds an extra layer of security by requiring users to provide a second form of verification, such as a temporary code generated on their smartphone or a biometric scan.
• Another option is phone-based One-Time Passwords (OTP), where users receive a unique code via SMS or a dedicated mobile app for each login attempt.

By exploring and implementing these modern authentication methods, you can further enhance the security and convenience of your system, offering users a more robust and user-friendly experience.

Thanks for caring 😘