search

rsanchez-wsu / fa15-ceg3120

11 stars 2 forks source link

PSWD Encryption for Use in Source #12

Open pquackenbush opened 9 years ago

pquackenbush commented 9 years ago

We should probably come up with a method for encrypting our passwords. And yes, I realize the flaw in discussing this in a publicly hosted site.

Nice explanation of pswd handling

rsanchez-wsu commented 9 years ago

@pquackenbush, though it may seem counter-intuitive, we should discuss our password handling in a public forum. If the algorithm itself is properly secure, we should be able to disclose it in a public forum and have every confidence that it won't help an attacker. If our password security were to rely on developing some secret method of securing the password such that public exposure of the secret method were to compromise the passwords, then we are relying on security through obscurity. We definitely don't want that.

joedobrovolc commented 8 years ago

Good source on password encryption in JAVA http://www.jasypt.org/howtoencryptuserpasswords.html

rsanchez-wsu commented 8 years ago

@joedobrovolc That is an excellent writeup