Solution: Store a Salted Hash of the Password
Explore how to securely store passwords in SQL databases by using one-way cryptographic hash functions combined with salts. Understand the weaknesses of older hashing algorithms and how salting defends against dictionary attacks and rainbow tables, ensuring safer authentication practices.
We'll cover the following...
The chief problem in the antipattern Readable Passwords is that the original form of the password is readable. But we can authenticate the user’s input against a password without reading it. This section describes how to implement this kind of secure password storage in an SQL database.
Understanding hash functions
We can do this by encoding the password using a one-way cryptographic hash function. This transforms the input string into a new string, called hash, which is unrecognizable. Even the length of the original string is obscured because the hash returned by a hash function is a fixed-length string. For example, the SHA-256 algorithm converts our example password, “xyzzy”, to a 256-bit string of bits, usually represented as a 64-character string of hexadecimal digits:
...