It's been a while I have been thinking on what could be the best scenario for creating a secure login in a client-server application running on internet or any other networks ! So I became with the idea to ask this question on programmers and I hope that this question will make awareness of new aspects of threads and security here by some kind of brain storming , I am really interested in good and new anseawres . Thanks in advance for your participation .
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Clean EVERYTHING that is inputted by the user (and even what is not). Make sure you hash/encrypt your sensitive data (i.e. passwords) -- I suggest using a salt with your password encryption.
I also suggest making it mandatory for passwords to be longer than 4 characters and have to include a number or two at least, so you don't get John Doe with the password cat ..
Edit I'm not sure what language your developing in but this may be handy to get an idea on what to do .. http://www.wikihow.com/Create-a-Secure-Login-Script-in-PHP-and-MySQL
Don't reinvent the wheel, especially when it comes to security. If at all possible, use tried-and-tested secure login packages. There are a lot of them out there depending on what platform you are targeting.
Since you mentioned you're a .NET programmer, be sure to take a look at Microsoft's Introduction to Membership.
As others have pointed out, it's better to use a package than to roll your own.