Password storage

Question

You already know of multiple browsers providing the capability of storing the credentials to log in websites. How do they properly secure the password if it cannot be salty-hashed?, the only way I found is by encrypting it only. Sites such as mint.com, save the credentials from multiple banks. How they make it is secured (code-wise)? Let say I am in a journey of implementing something similar, how can I really make sure the credentials are protected if cant hash them? Sources:

• https://www.mint.com/how-mint-works/security
• https://support.mozilla.org/en-US/kb/where-are-my-logins-stored
• Best practices for storing bank information in a database
• https://www.quora.com/Where-and-how-is-bank-account-information-stored-retrieved-and-updated

Answer 1

how can I really make sure the credentials are protected if cant hash them?

You can't; You can not make any guarantee that however you store a password (or any other data) is 100% secure.

When using a hash to store a password (loosely speaking) it simply prevents (or attempts to prevent) the original value from being calculated from the hash value.

You may want to update your question to something like What are the best practices for storing encrypted data securely against theft.

---

I'm not a security expert, but if I had data I wanted to store for other users that I did not want to access without the user present (physically or logged in), I would probably do something like require them to create a master password. I would create a unique Salt for each user and that is all I would store (along with the encrypted data). Then I would encrypt the data with the SHA3-512 (hash) of the master password + Salt. Theoretically, I don't have access to the data at all, not even for recovery purposes (because I don't store the hash nor the password).

Even in this case the data is not 100% secure. Someone could use a man-in-the-middle attack or compromise the system and steal the password/hash. The only known security feature of this is that it would be extremely difficult to decrypt the stolen data with only a Salt.

Answer 2

Store the data (credentials) in a database that is specially secured and hardened.

• It should not be accessible from the internet and there must be many levels of indirection between it and the internet.

• It should be accessible only from two specific systems. One is authorized to read the database and the other should also be able to make changes. So, you will need a dedicated firewall around this database. Make yourself familiar with multiple levels of demilitarized zones.

• Make sure that all your machines are properly patched. If you decide to use specific software, make sure to subscribe to the necessary channels to get information about available patches and possible exploits very fast and apply them quickly / find hotfixes.

• Configure only the least amount of permissions for your admins that are necessary to operate the infrastructure. Don't just give away those permissions to everybody that asks in your company.

• After you've done all that, encryption of this data does not offer much protection. It's just obfuscation at this point, because the key that encrypts the data must be close to the data.