Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

When developing login module for a web application, do you suggest to keep the username and password in a keystore? Lets assume the keystore was kept in a very safe place in web server.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

It's never a good idea to store passwords on the server anywhere, keystore or otherwise. It doesn't matter how safe you intend to keep the passwords -- you are still storing them somewhere, which introduces a set of possible vulnerabilities which are completely avoidable.

You should either be offloading the login process to an external provider (for exmaple, OpenID) or you should only be storing is password hashes (and associated salts). That way even if your server is compromised, the passwords would not be available without some brute force password cracking software (which still won't get strong passwords -- and won't get many weaker ones if you use a good password hashing algorithm like BCrypt).

As for where to store the password hashes, it doesn't really matter as long as it's meets your specifications for permanence and performance. Most people use a typical database to store these, but a simple key-value store (with permanence) would be fine for most applications.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.