Investigate password storage server-side

[richardbuckle]

Pascal, could you please investigate how passwords are stored server-side from a security point of view.

The criterion should be that if the worst happens and the database gets stolen, it should still be impossible to recover any user's password. To that end, the password itself should never be stored, whether encrypted or not. Only a salted one-way hash, using a computationally expensive cryptographic hash such as scrypt should be stored.

If you've any questions please ask.

[shtukas]

Ok, so we have two kinds of users. The regular mobile apps users and the admins.

The regular users do not have a password per se. The server authenticates them using their phone number (or device number, I need to double check). In any case they do not have a password.

The admin users (eg Robyn), have a user name and a password (to login to desk). The password is hashed by Laravel own password hashing interface, which uses Bcrypt. Looks like this in the database $2y$10$ZQo4xwwLcaWMnyzTK8LtXuiXg/SY23D1A80vF.1naNE2yqvEyiF3C (In particular I cannot recover the previous devs admin passwords) [Note that I will delete their account in the next few days].

[richardbuckle]

bcrypt will do. Is the part after the dot in your example the cryptographic salt?

[shtukas]

Um....

The hashing is actually done by PHP's password_hash function. Laravel doesn't provide a salt to it, only the clear password. In such a case a salt is automatically generated by the CRYPT_BLOWFISH algorithm. The PHP documentation actually specifies that it is better to let the algo generate a salt.

The answer to your question though is that the dot is meaningless. Other admin passwords do not have it. The only contants are the prefix $2y$ (which means that we used a standard crypt() compatible hash) and the length of the hash: 60 characters.

sources: nudj's code $admin->password = (string)Hash::make($request->password); https://github.com/laravel/framework/blob/5.2/src/Illuminate/Hashing/BcryptHasher.php http://php.net/manual/en/function.password-hash.php

[richardbuckle]

Good, we are doing the right thing here. Thanks for investigating!