I want to store user's password details in Database. My project is in Java. I want to know the best way of storing passwords and other important information like user data.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
A lot depends on your threat model, your system setup, etc. Do you require mutual authentication? Are connections secured with SSL or a similar protocol?
For passwords scrypt or bcrypt would be the way to go. They are better than just a simple salt + password setup. It has been recommended by someone worth trusting (our very own @ThomasPornin) that bcrypt might be a better choice right now. If you do require mutual authentication, using SRP (and simply storing the authenticator in a locked down database) would be a very good option.
For storing other user information, it really depends on your requirements (and even laws in your country of residence). The US has laws for storing credit card numbers, health care related information, etc. Do you require that the data be kept confidential even if someone steals the disk? If so, full disk encryption would be one solution. If you only require that no unauthorized entity can read the information, then locking down your database with good access control policies would probably be sufficient.