Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote -2 down vote favorite

It's been a while I have been thinking on what could be the best scenario for creating a secure login in a client-server application running on internet or any other networks ! So I became with the idea to ask this question on programmers and I hope that this question will make awareness of new aspects of threads and security here by some kind of brain storming , I am really interested in good and new anseawres . Thanks in advance for your participation .

share|improve this question
2  
Implementing security yourself is generally a bad idea. A good default choice is Asp.Net Membership, since it is: A) Included with ASP.NET, B) Well tested, and C) produced by experts. – Brian Oct 4 '12 at 20:23
Dear Brian ! this a a question to discuss on scenario ! I am really aware of asp.net membership ! – Karamafrooz Oct 4 '12 at 20:29
Perhaps I'm misunderstanding. What do you mean by 'best scenario'? What would be an example of a bad scenario? – Dan Pichelman Oct 4 '12 at 21:35

3 Answers

up vote 2 down vote

Clean EVERYTHING that is inputted by the user (and even what is not). Make sure you hash/encrypt your sensitive data (i.e. passwords) -- I suggest using a salt with your password encryption.

I also suggest making it mandatory for passwords to be longer than 4 characters and have to include a number or two at least, so you don't get John Doe with the password cat ..

Edit I'm not sure what language your developing in but this may be handy to get an idea on what to do .. http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL

share|improve this answer
you mean that It would be better to perform encryption or hashing on on client side and then sending the encrypted or hash data to server ? – Karamafrooz Oct 4 '12 at 19:38
Yes correct. Here's something more geared towards server side security, tho similar. cs.columbia.edu/~smb/classes/f06/l09.pdf – Braunson Oct 4 '12 at 19:39
So , assuming your answear is a good way , how can I perform hashing or encryption on client side using javascript without letting the client to be aware of my encryption or hashing algorithm ? and not letting him/her know the encrypting key ? – Karamafrooz Oct 4 '12 at 19:44
If It helps , I am a .net developer – Karamafrooz Oct 4 '12 at 19:55
1  
@Karamafrooz if you dont want the communication channel to be in plain-text, use SSL. Thats what its for. – GrandmasterB Oct 4 '12 at 20:12
show 3 more comments
up vote 2 down vote

Don't reinvent the wheel, especially when it comes to security. If at all possible, use tried-and-tested secure login packages. There are a lot of them out there depending on what platform you are targeting.

share|improve this answer
I don' want to reinvent ! I am looking for different good SCENARIOS so that I would be able to analize them and become with a good idea ! using packages ?! not a good idea ! especially when It comes to security ! – Karamafrooz Oct 4 '12 at 19:47
I also appreciate if you have any good scenario to share here ! – Karamafrooz Oct 4 '12 at 19:48
1  
@Karamafrooz - I would disagree with you on it being unsecure. Security is hard. So using an existing package (preferabbly open source) that has stood the test of time is a very valid option for production work. I can see where you are going if what you want to do is make this a learning project. Still, studying successful open sourced packages is a great way to learn. – System Down Oct 4 '12 at 19:50
any good references you could share the link with me or something ?! – Karamafrooz Oct 4 '12 at 19:54
References to good packages? That depends on the platform you're targeting. – System Down Oct 4 '12 at 19:55
show 2 more comments
up vote 0 down vote

Since you mentioned you're a .NET programmer, be sure to take a look at Microsoft's Introduction to Membership.

As others have pointed out, it's better to use a package than to roll your own.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.