I need to store a PW in a SQL table.
I would prefer it to not be clear-text and readable.
Do I use a one-way encryption? Is this what "salting" is?
What is the best practice to follow in this regard?
What do you all do for something like this????
I'm about to setup a new client with username and passwords that will be managed in the database.
I am not using the Membership provider - and I do not want to.
At any rate - other times I've done this I've stored the PW in clear text in a user table. I've seen commercial system that can send you your "existing" password so they must do basically the same thing.
I'm thinking for this setup I want to encrypt the password - probably a one-way encryption. Of course that means I can never give someone their password if they forget - I'll simply have to reset it to something unique and let them change it when they login.
What encryption methods are easy and quick to use?
Is there one I can do in Javascript so that I can encrypt in the browser and never have to actually POST a clear text password either??
Is this how hashed password stored in SQL Server should look like? This is function I use to hash password (I found it in some tutorial)
public string EncryptPassword(string password)
{
//we use codepage 1252 because that is what sql server uses
byte[] pwdBytes = Encoding.GetEncoding(1252).GetBytes(password);
byte[] hashBytes = System.Security.Cryptography.MD5.Create().ComputeHash(pwdBytes);
return Encoding.GetEncoding(1252).GetString(hashBytes);
}
EDIT: I tried to use sha-1 and now strings seem to look like as they are suppose to:
public string EncryptPassword(string password)
{
return FormsAuthentication.HashPasswordForStoringInConfigFile(password, "sha1");
}
// example output: 39A43BDB7827112409EFED3473F804E9E01DB4A8
Result from the image above looks like broken string, but this sha-1 looks normal....
I have a service (WCF) with which my ASP.NET page will communicate. The WCF service has hashed passwords in its data store (a file actually). The WCF service requires the username and the hashed password on every call. Nowm the problem I'm encountering is that if I authenticate the user with forms authentication in ASP.NET, a cookie will be saved in the user's computer after the user is authenticated but I would like to save the username and hashed password too so that the user may able to use the WCF service. Where should this information should be saved so that it is safe and secure? Should I use session variables? If I choose that option that, then should I switch from forms-based authentication and manually authenticate using session variables or use both forms-based autentication for web page access and store the username and hashed password in a session variable? What are the pros and cons of each?
View 2 RepliesI have an asp.net database which has users table. In this table password is saved as sncrypted. Now, I am creating my own users table. I want to copy user's data from my old table t this table. I can to decrypt old users table password. Which encryption technique is used by default in aspnet database for passwords.
View 2 RepliesI am writing a simple plugin for IE. I need to store a password and username setting for the user who uses the plugin. I know that I can store the username/password in the registry, I can manually encrypt it using the encription classes with .NET, or I can store it in a config file and encrypt the config file. I was wondering if there is a specific pattern/mechanism that I should use to store password and username.
View 1 Repliesfor maintain security, i encrypted my password and store in database like following
Dim PWD As
String = FormsAuthentication.HashPasswordForStoringInConfigFile(txtPassword.Text.Trim(),
"SHA1").Trim()
but problem is suppose user forget his password and need to know then how can i decrypted the password and send to the user?is there any other suitable way to handle password?
Even with https enabled, you can write a password to the event log in code-behind. Any way to keep that password encrypted in code while you're checking it against a data store?
(using Login control)
(couldn't add comment to Andrew's answer, so I'm putting it here)
NTLM uses the username/password of the machine the user is logged into right? For this, I was thinking using ActiveDirectory on the server as the data store. It would have a diferrent un/pw than what the user is currently signed in to their machine as.
I want to to encrypt password show me the query for encryption password
View 1 RepliesI have an aspx box with with to asp controls; one text box for entering a password and a button for submitting. Now, when the user enters a password he has to click the submit button.
I want to set it up so the after the user enters a password all he has to do is hit the enter key on the keyboad instead of having to click the submit button. I want it to work just like it does on this forum; all I have to do is enter my user name and password and hit the enter key on the keyboad. The only difference is that I only have a password field and not a user name field.
I tried setting the password to autopost back and it didn't work or at least I didn't have the code correct.
[URL]above url contain a html table.I want to save this table value on XML and also want to save this table value on database MS2008.How to save html table values on database
View 3 RepliesI have an application that needs to send out several different types of emails.
Currently I am using string.format with placeholders to make the template like this
Code:
Dim body as string = String.Format("<p>hello {0}</p>", "bob") Is there any other ways to store these email templates like using xml or something?
-edit the emails will be in HTML format
How to use two textboxes as a login and password fileds so the browser will ask users if thwy want the browser to remember their credentials?
View 6 RepliesI need to store passwords provided by the user. Yes, passwords. I could not use Hashes because I need to supply the password to another external service for authentication, and therefore I need to have the password.
What is the best and most secure way to store the passwords? As the external data provides private data it is of course very important that the password in my MS SQL DB is stored as safe as possible.
I have store procedure: ALTER PROCEDURE dbo.GetAllInfoFromUsers(@name varchar(50)) AS select id, userName,password, role from tbl_users where userName=@name
Then I have Report.aspx page:
<asp:Content ID="Content1" ContentPlaceHolderID="ContentPlaceHolder1" Runat="Server">
<CR:CrystalReportViewer ID="CrystalReportViewer1" runat="server"
AutoDataBind="True" Height="1106px"
Width="876px" />
[Code]....
I have dataset (MyDataset) build out of store procedure. and I have StoreCrystalReport.rpt linked to MyDataset.
I am unable to see the filtered output in crystal report.
When I create a new login for my SQL Server 2008 I also specify a password for this login. But when I, after the creation is done, check the login's properties the password is much longer than the one I specified. If I here change the password once again, SQL Server 2008 will automatically change the password for the login - again. ANd I don't know what the password that SQL Server keep putting for my logins, since the password consists of small black dots.
View 4 RepliesHow could one set a password on a database in Sql server 2005 & 2008
View 3 RepliesI have the asp.net with authentication set to forms. After deploying new version on server it started to display a UsernName Password dialog box (like in windows authentication) on the login.aspx page.
When user click "cancel" the login.aspx page displays normally and user could log in and continue his work normally.
I don`t know how to get rid of that dialog box? Anonymous login on IIS is enabled, and the anonymous IIS user has access to that file - login.aspx
I have a custom membership user class and custom MembershipProvider working against database. Due to security reasons the user passwords are stored in the database as hashed values. So my procedure
public override bool ValidateUser(string username, string password) is
{
//select hashed password from db
return (EncodePassword(password) == dbpassword)
}
[code]....
I have an entity called a file which is the main part of my project. The file has invoices and timesheets captured against it. So I have a file tab with info about the file, like FileNumber, Vessedl, Voyage etc. Now I need to be able to upload documents for the file. So I will add an uploads tab. But the uploaded documents need to be saved for the specified file the user uploads it for. then when a user opens a file I need to show the documents for that file in a list of some sort. the best way to do this. What's the best way to upload multiple files? should I store all the info in my database?
View 36 RepliesI have been using profiles to store a list of user defined clicks. A user clicks on items and it adds it to my Shopping Cart.
I have managed to enter all the info I need and see that It is there with a count but I can't pull the information back once I have entered it.
First thing I did was add code to my Web.config under System.web
[code]....
Then I created a Class called ShoppingCart.vb
[Code]...
Okay here is my VB code where I need to be able to pull the information back again.
[Code]...
So I may need to give you more information but the basics are:
I can add items to my list with btnAddS and it will update my label with the correct amount of rows (items)
Under my btnView I can iterate through the rows (items) but I can't pull back the information stored within.
I need to store viewstate in session to optimize my page performance on postback.
I am developing ASP.Net Website, using Visual Studio 2008.
I created a class named "BasePage" under "App_Code".
[Code]....
Now, I know if I inherit this class in all of my pages, that will work but I am looking to do this through Config file.
Is there any way that I can write something in Config file to use this class for all the pages?
so that if I want to remove, I can simply remove from config file and I do not need to compile my whole project again.
I can recover my password but when I try to change my password to something a bit easier to remember it gives me:
Password incorrect or New Password invalid. New Password length minimum: 7. Non-alphanumeric characters required: 1.
I need to read and store data from tableOne, then insert those data to tableTwo.
View 5 RepliesI have a textbox and I want to add multi lines in this textbox ex. "I am a student my name is xxxx"
then I want to store the previous lines into a table ,,,, then I need to display these lines into an <asp:Label> and I need to keep the same format for these lines such that display each sentence in a line as I enter it into the textbox !!