programmingnoob

I mean I know what the term means and what it does...
but should every internet application that requires login information etc use it for password and such?

kruptof

There are other methods of authentication, but username and password i think are the easiest to implement.

__________________

Infinite Recursion

Without having a form of secure authentication, encrypted password or otherwise, you are asking for trouble.

__________________
http://jasonpowers.net

"There are a thousand hacking at the branches of evil to one who is striking at the root."

Satans_Banjo

Usually with websites when users sign up to the website and set their password their password is encrypted in a way that can't be reversed. Then, each time the user enters their password to log in this password is encrypted in the same way and compared to the encrypted version of the password they provided. If these encrypted passwords match then the user can enter the website. This way if someone manages to view the passwords stored in the database all they can see is the encrypted passwords and therefore they can't reverse engineer them because that one encrypted password could be the result of several different passwords

programmingnoob

that helps.....
so basically it's making sure that even if someone gets hold of database, he gets nothing that could harm anybody?
cool

Satans_Banjo

Exactly. Although they would still have peoples' e-mail addresses so that could be irritating but nothing that could be used really maliciously

programmingnoob

i thought encrypted password was a form of secure authentication =/

Booooze

Not exactly all true. Remember the user can always run a brute-force or dictionary attack the on database/file. I remember reading an article where one administrator ran a brute force attack on a file that contained all the usernames and passwords for a company. It totaled about 800 employees. He broke all the passwords in 3 minutes. Turns out all the users were using extremely common passwords. The article is somewhere on IT Canada I think.

Satans_Banjo

Yeah but all password encryption is susceptible to brute force, it just depends on how long it takes. And dictionary attacks could always be used if people keep simple passwords

programmingnoob

hmmm ... so what do I do to guard against that? =/