如何安全地将密码存储在数据库中? [英] How to store passwords in database securely?

问题描述

我已阅读到将密码存储在数据库中的一种方法是通过以下方式.拥有一个包含用户名、哈希和盐列的数据库表.永远不会显示盐.

I have read that one way to store passowrds in a database is by the following way. To have a database table with columns username, hash and salt. The salt would never be shown.

我用密码+盐生成哈希.密码由用户发送，不存储在数据库中.如果生成的hash与数据库中存储的hash相同，则密码正确.

I generate the hash with password + salt. The password is send by the user and is not stored in the database. If the generated hash is the same as that stored in the database, the password is correct.

但我有疑问.如果我发送密码，它可能会在通过有线传输时被嗅探，所以我认为加密通信也是必要的.那么使用哈希和盐只是为了保护数据免受管理员的侵害?我的意思是，如果我将密码存储在数据库中，管理员可以轻松访问所有信息.如果我存储哈希，管理员无法访问用户的信息，因为管理员没有一半的信息，只有盐，没有密码.但是，当用户需要发送密码时，这可能会被某人嗅探，因此密码会暴露出来.

But I have my doubts. If I send the password, it could be sniffed while it is transmitted by the wire, so I think that it is neccesary to encrypt the communication too. So using a hash and salt is only to protect the data from the administrator? I mean that if I store the password in database, an administrator could easily access all information. If I store the hash, the administrators can't access to the information of users becasue the administrator don't have the half of the information, only the salt and not the password. However, while the user need to send the password, this could be sniff by someone, so the password is exposed.

保护用户信息的最佳方式是什么?

How is the best way to protect the information of the user?

谢谢.

推荐答案

哈希密码还可以保护您的数据免受外人的侵害.想象一下，如果有人使用 SQL 注入访问您的数据，他只会得到一个哈希值 &不是通行证.您可以使用 HTTPS 通过您的网络进行安全通信使用您现有的散列密码表以获得良好的安全模型.安全加盐密码散列

Hashed passwords also protect your data from outsiders. Imagine, if someone accessed your data using a SQL injection he would only get a hash & not the pass. You can use HTTPS for secure communication over your network & use your existing table of hashed passwords for a good security model. Secure salted password hashing

这篇关于如何安全地将密码存储在数据库中?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！