user login and passwords

[dee]

Hi
I'm writing a page withing our site that requires logins. Where should the
logins and passwords be kept? SqlServer/Access? Flat files? What are the
options and trade offs?
Thanks.
Dee

[Lucas Tam]

"dee" <de*@home.net> wrote in
news:uf**************@TK2MSFTNGP09.phx.gbl:

I'm writing a page withing our site that requires logins. Where should
the logins and passwords be kept? SqlServer/Access? Flat files? What
are the options and trade offs?

Anywhere you like, but you want want to hash the passwords for security.

SQL Server or Access is probably the best for easy retrieval.

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

[dee]

Thanks for response.
Is hashing recommended even when database is used?

"Lucas Tam" <RE********@rogers.com> wrote in message
news:Xn***************************@127.0.0.1...

"dee" <de*@home.net> wrote in
news:uf**************@TK2MSFTNGP09.phx.gbl:

I'm writing a page withing our site that requires logins. Where should
the logins and passwords be kept? SqlServer/Access? Flat files? What
are the options and trade offs?

Anywhere you like, but you want want to hash the passwords for security.

SQL Server or Access is probably the best for easy retrieval.

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

[Marina]

Yes, otherwise the administrator of the database, or someone who gains
access to the database can see everyone's password in plain text.

"dee" <de*@home.net> wrote in message
news:u9**************@TK2MSFTNGP12.phx.gbl...

Thanks for response.
Is hashing recommended even when database is used?

"Lucas Tam" <RE********@rogers.com> wrote in message
news:Xn***************************@127.0.0.1...

"dee" <de*@home.net> wrote in
news:uf**************@TK2MSFTNGP09.phx.gbl:

I'm writing a page withing our site that requires logins. Where should
the logins and passwords be kept? SqlServer/Access? Flat files? What
are the options and trade offs?

Anywhere you like, but you want want to hash the passwords for security.

SQL Server or Access is probably the best for easy retrieval.

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

[tom pester]

Hi Dee,

I really suggest you look into asp.net 2 (I am on a quest to let every living
soul upgrad to v2 so I maybe biased) :

New Security Features in ASP.NET 2.0 http://msdn.microsoft.com/library/en...asp?frame=true
22/08/2005 15:47:47
Securing ASP.NET Applications - With Less Code http://msdn.microsoft.com/library/en...asp?frame=true
22/08/2005 15:46:52
New Membership Features in ASP.NET Whidbey http://msdn.microsoft.com/library/en...asp?frame=true
22/08/2005 15:46:15

If you use v2 then:

- The choice between sql server and access is transparent (access provider
will be available after the official release but I would use sql server (express)
anyway)
- You don't write a single line of code (and as a consequence give the user
more functions like recovery, secret questions,...)
- Your solution is very safe (The passes are salted out of the box. Which
developer did this in the past? My guess is <1%)
- You will feel like an action hero and thus look cooler than your colleagues
(that's why I do it)
Cheers,
Tom Pester

Hi
I'm writing a page withing our site that requires logins. Where should
the
logins and passwords be kept? SqlServer/Access? Flat files? What are
the
options and trade offs?
Thanks.
Dee

[UJ]

When you say 'hash' the variable, what does that mean? I do it all manually
through triggers but is there an easier way?

TIA - Jeffrey.

"Marina" <so*****@nospam.com> wrote in message
news:%2****************@tk2msftngp13.phx.gbl...

Yes, otherwise the administrator of the database, or someone who gains
access to the database can see everyone's password in plain text.

"dee" <de*@home.net> wrote in message
news:u9**************@TK2MSFTNGP12.phx.gbl...

Thanks for response.
Is hashing recommended even when database is used?

"Lucas Tam" <RE********@rogers.com> wrote in message
news:Xn***************************@127.0.0.1...

"dee" <de*@home.net> wrote in
news:uf**************@TK2MSFTNGP09.phx.gbl:

I'm writing a page withing our site that requires logins. Where should
the logins and passwords be kept? SqlServer/Access? Flat files? What
are the options and trade offs?

Anywhere you like, but you want want to hash the passwords for security.

SQL Server or Access is probably the best for easy retrieval.

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

[tom pester]

http://en.wikipedia.org/wiki/Hash_function

Cheers,
Tom Pester

When you say 'hash' the variable, what does that mean? I do it all
manually through triggers but is there an easier way?

TIA - Jeffrey.

"Marina" <so*****@nospam.com> wrote in message
news:%2****************@tk2msftngp13.phx.gbl...

Yes, otherwise the administrator of the database, or someone who
gains access to the database can see everyone's password in plain
text.

"dee" <de*@home.net> wrote in message
news:u9**************@TK2MSFTNGP12.phx.gbl...

Thanks for response.
Is hashing recommended even when database is used?
"Lucas Tam" <RE********@rogers.com> wrote in message
news:Xn***************************@127.0.0.1...

"dee" <de*@home.net> wrote in
news:uf**************@TK2MSFTNGP09.phx.gbl:
> I'm writing a page withing our site that requires logins. Where
> should the logins and passwords be kept? SqlServer/Access? Flat
> files? What are the options and trade offs?
>
Anywhere you like, but you want want to hash the passwords for
security.

SQL Server or Access is probably the best for easy retrieval.

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

[Marina]

It means encrypt it.

"UJ" <fr**@nowhere.com> wrote in message
news:uF**************@TK2MSFTNGP15.phx.gbl...

When you say 'hash' the variable, what does that mean? I do it all
manually through triggers but is there an easier way?

TIA - Jeffrey.

"Marina" <so*****@nospam.com> wrote in message
news:%2****************@tk2msftngp13.phx.gbl...

Yes, otherwise the administrator of the database, or someone who gains
access to the database can see everyone's password in plain text.

"dee" <de*@home.net> wrote in message
news:u9**************@TK2MSFTNGP12.phx.gbl...

Thanks for response.
Is hashing recommended even when database is used?

"Lucas Tam" <RE********@rogers.com> wrote in message
news:Xn***************************@127.0.0.1...
"dee" <de*@home.net> wrote in
news:uf**************@TK2MSFTNGP09.phx.gbl:

> I'm writing a page withing our site that requires logins. Where should
> the logins and passwords be kept? SqlServer/Access? Flat files? What
> are the options and trade offs?

Anywhere you like, but you want want to hash the passwords for
security.

SQL Server or Access is probably the best for easy retrieval.

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

[dee]

Thanks Tom

"tom pester" <To********************@pandora.be> wrote in message
news:a1***************************@news.microsoft. com...

Hi Dee,

I really suggest you look into asp.net 2 (I am on a quest to let every
living soul upgrad to v2 so I maybe biased) :

New Security Features in ASP.NET 2.0
http://msdn.microsoft.com/library/en...asp?frame=true
22/08/2005 15:47:47 Securing ASP.NET Applications - With Less Code
http://msdn.microsoft.com/library/en...asp?frame=true
22/08/2005 15:46:52 New Membership Features in ASP.NET Whidbey
http://msdn.microsoft.com/library/en...asp?frame=true
22/08/2005 15:46:15
If you use v2 then:

- The choice between sql server and access is transparent (access provider
will be available after the official release but I would use sql server
(express) anyway)
- You don't write a single line of code (and as a consequence give the
user more functions like recovery, secret questions,...)
- Your solution is very safe (The passes are salted out of the box. Which
developer did this in the past? My guess is <1%)
- You will feel like an action hero and thus look cooler than your
colleagues (that's why I do it)
Cheers,
Tom Pester

Hi
I'm writing a page withing our site that requires logins. Where should
the
logins and passwords be kept? SqlServer/Access? Flat files? What are
the
options and trade offs?
Thanks.
Dee

[dee]

Thanks Marina

"Marina" <so*****@nospam.com> wrote in message
news:%2****************@tk2msftngp13.phx.gbl...

Yes, otherwise the administrator of the database, or someone who gains
access to the database can see everyone's password in plain text.

"dee" <de*@home.net> wrote in message
news:u9**************@TK2MSFTNGP12.phx.gbl...

Thanks for response.
Is hashing recommended even when database is used?

"Lucas Tam" <RE********@rogers.com> wrote in message
news:Xn***************************@127.0.0.1...

"dee" <de*@home.net> wrote in
news:uf**************@TK2MSFTNGP09.phx.gbl:

I'm writing a page withing our site that requires logins. Where should
the logins and passwords be kept? SqlServer/Access? Flat files? What
are the options and trade offs?

Anywhere you like, but you want want to hash the passwords for security.

SQL Server or Access is probably the best for easy retrieval.

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

[Lucas Tam]

"Marina" <so*****@nospam.com> wrote in
news:uG*************@TK2MSFTNGP15.phx.gbl:

It means encrypt it.

Nope don't confuse hashes with encryption.

Encryption is a 2-way process, you can encrypt and decrypt. Hashes on the
otherhand are not decryptable (once hashed, the original data is lost).

--
Lucas Tam (RE********@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/