Hi, after managing to get most of my application working as expected I just have a question about user password storage before the app is released.
Currently when a user resets their password they get an email with a new pass to login to their account, my concern is that the server shouldn’t be able to have the users password at all due to the fact that it should be encrypted and passwords should be compared based on the encrypted versions.
This website explains things much better than I do: http://plaintextoffenders.com/
Hi, Benjamin,
We store only encrypted passwords in our database. The one which is generated and sent to email is also encrypted and only after that is saved.
Thanks, but my main concern is that the password is the way the password is encrypted. If it’s encrypted properly the user should never be able to see the password. For example a hash and salt of the password where it’s encrypted one way so it can’t be decrypted (in a reasonable time frame).
If the user cannot see the password, how would they be able to login when the password is generated by the system?
Password reset URL instead of sending them a new password. My main concern though is still how they’re encrypted.
This page explains what I’m trying to get across: http://codahale.com/how-to-safely-store-a-password/
I just want to be sure my user’s data is secure even in the worst of scenarios.
In the persistent storage passwords are encrypted with hash and salt. It would be impossible to retrieve the actual password if the raw bytes were obtained by someone.
As for password reset, there are two available options: reset in the free plan, which is what you have experienced and the reset in Backendless Plus, which works exactly as you described (with a URL pointing to a customizable online form).
Regards,
Mark
