Clash Royale CLAN TAG#URR8PPP

Storing usernames and passwords securely

I am currently in the process of creating my own Web Application and I am implementing a login function. I have read that using 'google sign in' feature is a good option so I have included this.

I would also like to store the usernames & passwords( just to learn about hashing and gain some experience in this). I was wondering if SHA256 is still secure using a strong salt or are there newer algorithms I should research?

I found a similar question here but it is 6 years old and think a more up to date answer could be more helpful.

3 Answers
3

Probably you should not be thinking about implementing your own authentication at all. Instead, you should be using a framework that offers solid and well-tested authentication. Any serious web framework will provide at least one good option here, so it will not hinder your choice of technology in any way and will certainly make your work easier and more secure.

That being said, a review of standard sources suggests that SHA-512 and SHA-3 are the most-favored candidates if you were going to implement your own authentication. Which again I do not recommend.

As far as I know SHA256 isn't broken yet and the computation time is still enough.
If you're using a big enough salt it should be secure.

only if you don't use a alt you're vulnerable the use of rainbow tables, dictionaries attacks.

Also make sure to build in minimum requirement on the password to prevent brute force attacks.

Checkout this post ;-)

https://crypto.stackexchange.com/questions/52571/computational-requirements-for-breaking-sha-256

Hope this helps.

Best regards Ken

For those that are rolling their own: there are some details to look into.

Do not store a password but a digital fingerprint of a password. This prevents stealing of passwords should the database be violated. Alternatively some databases know password fields that are checked by the database. Check yourself that the database uses sufficiently strong passwords.

And against virus snooping of the JVM's memory do not use PreparedStatement.setString, but see here for some security measures.

(Some hashes suffer that (with same length) for passwords starting with the same prefix the deciphering can be done faster. In that case a random seed is used.)

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.