The standard way to store passwords is... not to store passwords. Instead, store a salted hash of the password in a database. When you get a purported password, you re-salt it, compute the hash, and determine if they are the same. This is how Unix has done it for years. You want bigger hashes and salts than the old Unix systems, and you still want to prevent reading from those files (to foil password crackers). More info is in my book at: http://www.dwheeler.com/secure-programs --- David A. Wheeler dwheelerat_private
This archive was generated by hypermail 2b30 : Fri Aug 23 2002 - 09:49:03 PDT