I want to store user's password details in Database. My project is in Java. I want to know the best way of storing passwords and other important information like user data.

  • 2
    $\begingroup$ Use this mindrot.org/projects/jBCrypt $\endgroup$ – dchest Oct 18 '12 at 10:44
  • $\begingroup$ Thanks a lot for the solution. But I want the solution which is well defined standardized API. like Apache etc., please provide me API for that standard, on which I can trust as per industry standards $\endgroup$ – Bhavik Ambani Oct 19 '12 at 4:46
  • $\begingroup$ Asking for "the best way of storing passwords" is asking for pretty subjective feedback and may quickly render the whole thing off-topic. Not only due to that, I would advise you to add a bit more information to your question, describing the exact threat model you are expecting, what system, etc. We don't even know if you use a database or flatfile storage, or if you're using any kind of networking in your Java project. Without such information, all answers will be pretty broad as they will have to guess/assume such important information, and can't really cover your individual situation. $\endgroup$ – e-sushi Oct 29 '13 at 0:52
  • $\begingroup$ "Industry Standards" when it comes to password storage are complete crap, essentially a single iteration hash with no salt. The "best" option is currently SRP6a with H = scrypt, the easiest "standard" option is PKBF2-SHA256. Either one may be bad/excellent based on your environment and requirements, and may require explicit parameter choices. $\endgroup$ – Richie Frame Oct 29 '13 at 5:42
  • $\begingroup$ @RichieFrame PKBF2-SHA256 is a bit tricky as it is not always supported in frameworks, PKBF2-SHA1 is only slightly less safe and output less bits (per "block") and is normally supported. So it could be a better choice, but it depends on the application... $\endgroup$ – Maarten Bodewes Oct 30 '13 at 16:38

A lot depends on your threat model, your system setup, etc. Do you require mutual authentication? Are connections secured with SSL or a similar protocol?

For passwords scrypt or bcrypt would be the way to go. They are better than just a simple salt + password setup. It has been recommended by someone worth trusting (our very own @ThomasPornin) that bcrypt might be a better choice right now. If you do require mutual authentication, using SRP (and simply storing the authenticator in a locked down database) would be a very good option.

For storing other user information, it really depends on your requirements (and even laws in your country of residence). The US has laws for storing credit card numbers, health care related information, etc. Do you require that the data be kept confidential even if someone steals the disk? If so, full disk encryption would be one solution. If you only require that no unauthorized entity can read the information, then locking down your database with good access control policies would probably be sufficient.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.