Security - It Doesn't Seem Possible?

  • Thread starter Thread starter Ian Evitable
  • Start date Start date
I

Ian Evitable

Hello

Im struggling with the concept of application security. At this point i dont
see how it works nor how its possible in a shared web-hosting environment.

If i require a user logon to access the site i need somewhere to store the
user credentials say a database. So i encrypt them as they sit in the
database. But if someone hacks the server and can download a copy of both
the database and the application then they can easily use ILDasm to check
out how to decrypt the encrypted database passwords because my application
needs to do this in order to verify that a users login was correct.

So basically why bother with internal application encryption at all if the
whole system falls apart once someone can bypass the front gate (server). I
just dont get it.

If i use a one way hash then the password must become disposable as i cant
un-hash it but rather only compare new input to the existing hash. So if
thats the case then how come almost every site i have registered for is able
to send me my password if i "forget it"..... inclusing my bank.

Clearly they are using encrypt/decrypt model.... which goes back to why
bother. One an attacker is through the front gate your done like a dogs
dinner anyway.

Thanks
Ian
 
There are differing levels of compromise on a system. Hackers gaining access
to your code or your database do not necessarily have both. Total system
security failures are anomolies and not the norm.

I prefer one-way hashes for very secure sites. But, security is a two way
street. There are times that you have to loosen a bit to compromise with
other aspects of programming.

It is a constant battle against hackers and you slowly, but surely, add a
level of protection. The hacker is also working to gain access and find some
hole in the system.

--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

***************************
Think Outside the Box!
***************************
 
Seems to me that CredentialCache will do a lot of this for you, or, to get
deeper in, the CredRead, CredWrite and other APIs that store passwords a bit
more securely than your database and without exposing the algorithm.
 
Back
Top