Password Storage Cheat Sheet  Revision as of 20:04, 24 November
2011 by Jmanico (Talk | contribs)  Jump to: navigation, search
This article is focused on providing guidance to storing a
password in order to help prevent password theft. Too often
passwords are stored as clear text. Thus the password can be
read directly by the database’s administrator, super users or
via data theft by SQL Injection. Database backup media is also
vulnerable to password theft via password storage. It is
recommended that you avoid storing the clear text password or an
encrypted version of the password.  Password Storage Rules
Passwords are secrets. There is no reason to decrypt them under
any circumstances. It is crucial that passwords are stored in a
way that they can be *verified* but not *reversed* in any way,
even by insiders. To accomplish this, store the salted hashed
value of the password. Preferably use a different random salt
for each password hash instead of a constant long salt.  Use a
modern hash    Use a long cr