i seemed Confused what i need to do.it a normal login scenario.i storing hashed value of password in database.[Please dont consider What Hashing Function i Using ].At The Login Time
user inputs his plain Text Password.Now what i needed to Do is hash this password ,pass it web service Then My DataBase Need to Compare Two Hashed Values.Now what i dont know is.
When i hash the Password at login time with salt.Is it still the same value i get or Something else
Can My dataBase(Sql server 2008) Able to Compare Two Hashed Values if Not then what i need to do.There is no need of Get the Password From Database.
Passing Hashed Password over Web services needs Extra Consideration of Security?
i need to Handle Password Recovery also.and can i use encryption/decryption algorithms here.
Please Suggest What i need to Do .
To increase security, it would be better to use a random salt.
The way i use to protect password while storing in the SQL server is that:
Create salt from the password, then generate hash with concatenation
of user name and password..
It will make the salt dependent on password and user name. If you are recovering your password then if credentials are correct then you are able to reset the password.
can i use encryption/decryption algorithms
??
As per your encryption method, Create your own algorithm to encrypt and decrypt the password with salt using the .net encryption libraries.
You have to save salt to database too.
in Authentication, Get salt, hashed inputted password with salt, compare with the hased value in database. All of these can reside in C# code.
You can't get original password from hashed value. You can generate a random password and force customer to change password in next login.
So I think hashed value is safe to transfer online. For a site Adminstrator, even he has access to database, he still doesn't know the password of customer.
Related
I am working on creating a web application to assign user access to a database. We get a ticket to grant access to a user and the help desk person select the sql instance, enters the username and the password on the app to assign access. My issue is the connection strings are all stored in a sql database and the instance password is encrypted using hashbyte function.
How am i going to connect to the database through my C# asp.net code since the password is encrypted.The help desk person will only select the instance and not enter the login credentials
This kind of operation is needed to be one-way so that it cannot be decrypted. Password validation is generally done with hashing. in other words, you have hashed password inside db and when user inputs password, your application first hashes the input password then it compares hashed passwords.
but, hashing is not encryption algorithm, it is a secure one-way compression algorithm
Thus, you cannot use hashed db passwords for any purpose. users need to provide password.
You can use UserSecrets for storing encrypted password. Check this post for implementation
In a C# MVC app that is using the OAuth login method, how do you retrieve the decrypted password for the current logged in user?
I know
User.Identity.GetUserName()
Gets the user name but, in the table AspNetUseres is a PasswordHash column with the hashed password and I want to be able to retrieve that and decrypt it if needed in the app. I can retrieve the hashed string fine but unsure how to convert it into text...
You can't. The whole point of hashing is to obscure data in such a way so you can verify it, but can't see the actual value.
To be able to encrypt / decrypt values, you would need to set up password encryption, not hashing.
But you shouldn't be decrypting user passwords anyway. If you want to mention why you need the password, perhaps someone here could suggest an alternative way of getting what you want.
I am totally new to Asp.net mvc. I am trying to implement token based authentication on my Asp.net mvc app. I have implemented it successfully according to http://www.primaryobjects.com/2015/05/08/token-based-authentication-for-web-service-apis-in-c-mvc-net/
Where client generated token is sent with each http request. In the server side I process this token and get the data in it to generate a token in the server side to compare with. Where my token contains the data username, password, ip, user agent and time stamp. in the server side I get the username from client token and retriev the password from database to generate token in the server.
Now the problem is my application has changed to store encrypted password in the database using BCrypt.Net.BCrypt.HashPassword. Now the problem is using this BCrypt api I unable to decrypt the hash password to get the original password. So I have no idea how to generate the token in server side. Any ideas on this are highly appreaciated
This is the nature of a hash. You can hash a text string(password), but you can not reverse it and get the original input. This is because multiple text strings get hashed to the same hash.
So there is no way to say what is the original input by looking at the hash.
To verify the user has input the correct password you can use BCrypt.Verify("my password", passwordHash)
It returns true if your new password matches with the hash. Please note that you cannot hash the password again and just check whether the two hashes are equal because for the same string you get different hashes each time as it adds a random salt value to the original string. So you have to use the BCrypt.Verify for checking passwords. You can choose a different schema for the token or encrypt the password and store in the database if you want to retrieve it later. But usually passwords are hashed when storing in the database for additional security.
I have a task where I need to verify a users password using BCrypt before they can retrieve their transaction details out of a database, the password for the account has already been hashed and put into the database. I am new to BCrypt and I have no idea where to begin. I just need some help understanding how BCrypt works and also I need to know how to compare a user entered password (via an Input Box) to an encrypted password in a database so that the user can retrieve their information.
I am new to BCrypt and I have no idea where to begin
This can be a good start. read the details here
I just need some help understanding how BCrypt works
A .Net port of jBCrypt implemented in C#. It uses a variant of the Blowfish encryption algorithm’s keying schedule, and introduces a work factor, which allows you to determine how expensive the hash function will be, allowing the algorithm to be "future-proof".
I need to know how to compare a user entered password (via an Input Box) to an encrypted password in a database so that the user can retrieve their information.
This article contains a full example of how to do that.
I am trying to create a secure password login screen in c#.Right now i have just created the login screen and I am able to read the username and password from the database.But which i have designed does not have an encrypted password. Can any one help me out how to write a query to generate encrypted password and store the encrypted password value in a separate field.Thanks in advance.
Consider hashing the password that you currently store. SQL can hash a password as follows:
DECLARE #HashThisPassword nvarchar(4000);
SELECT #HashThisPassword = CONVERT(nvarchar(4000),'dslfdkjLK85kldhnv$n000#knf');
SELECT HashBytes('SHA1', #HashThisPassword);
... But SQL shouldn't even need to do this. You should hash the password as soon as your C# application receives it, and then only ever pass the hashed password into SQL to be saved. When checking if the user has provided the correct password for login, compare the hashes.
Your best bet is one way encryption.
What happens in this scenario is the user selects/is given a password. When that password is stored in the database it passes thorugh this one way encryption before it is stored. (You'll be doing this in your c# code)
Then when the user logs in, the entered password passes through this same one way encryption before it is compared with the password in the database.
This ensures that if a hacker gets into the database, it will be difficult to learn the password because they would have to determine the encryption type, and then devise a way to un-encrypt it which to my understanding is difficult at best, impossible at worst.
Here is a link to some code that may help. One Way Encryption
You don't want to do the encryption in sql itself, because if a hacker DOES access your database, they will be able to simply look at the procedure/function that you are using to do the encryption and they will have a much easier time.
And you don't want to store the password in the database unencrypted as well...
Your best bet is to write some code to read the password, encrypt it, and update the record, then all you have to do is continue to use the same encryption type and salt.
The c# cryptography library is very easy to use.