Storing usernames and passwords securely

Question

I am currently in the process of creating my own Web Application and I am implementing a login function. I have read that using 'google sign in' feature is a good option so I have included this.

I would also like to store the usernames & passwords( just to learn about hashing and gain some experience in this). I was wondering if SHA256 is still secure using a strong salt or are there newer algorithms I should research?

I found a similar question here but it is 6 years old and think a more up to date answer could be more helpful.

score 3 · Accepted Answer · answered Aug 10 '18 at 14:44

3

Probably you should not be thinking about implementing your own authentication at all. Instead, you should be using a framework that offers solid and well-tested authentication. Any serious web framework will provide at least one good option here, so it will not hinder your choice of technology in any way and will certainly make your work easier and more secure.

That being said, a review of standard sources suggests that SHA-512 and SHA-3 are the most-favored candidates if you were going to implement your own authentication. Which again I do not recommend.

answered Aug 10 '18 at 14:44

Jon Kiparsky

7,499
2
23
38

1

This answer helped. I Know its no entirely secure, was just something I wanted to do some research on. Thank you – a.nolan Aug 10 '18 at 15:10
Reinventing wheels for research purposes is not a bad idea at all. It's a good way to learn to make nice round wheels. Have fun! – Jon Kiparsky Aug 10 '18 at 17:32

score 1 · Answer 2 · answered Aug 10 '18 at 15:06

1

As far as I know SHA256 isn't broken yet and the computation time is still enough. If you're using a big enough salt it should be secure.

only if you don't use a alt you're vulnerable the use of rainbow tables, dictionaries attacks.

Also make sure to build in minimum requirement on the password to prevent brute force attacks.

Checkout this post ;-)

https://crypto.stackexchange.com/questions/52571/computational-requirements-for-breaking-sha-256

Hope this helps.

Best regards Ken

answered Aug 10 '18 at 15:06

crimmy68

11
1

I will look into that link, Thank you. – a.nolan Aug 10 '18 at 15:11
Ofcourse you can also play on safe side and go for SHA-512 instead :-) – crimmy68 Aug 10 '18 at 15:20

score 0 · Answer 3 · answered Aug 10 '18 at 15:13

For those that are rolling their own: there are some details to look into.

Do not store a password but a digital fingerprint of a password. This prevents stealing of passwords should the database be violated. Alternatively some databases know password fields that are checked by the database. Check yourself that the database uses sufficiently strong passwords.

And against virus snooping of the JVM's memory do not use PreparedStatement.setString, but see here for some security measures.

(Some hashes suffer that (with same length) for passwords starting with the same prefix the deciphering can be done faster. In that case a random seed is used.)

Storing usernames and passwords securely

3 Answers3