How do you do secure logins?

Discussion in 'Programming' started by stupidfly, Jun 1, 2007.

  1. #1
    I am making a script, probably in PHP, and it will be important that people cannot use it because the system will involve credits and a hack into the script could cost me a lot of money and/or a lot of apology e-mails.

    What do you guys use to login to your scripts? How secure is it?
     
    stupidfly, Jun 1, 2007 IP
  2. it career

    it career Notable Member

    Messages:
    3,562
    Likes Received:
    155
    Best Answers:
    0
    Trophy Points:
    270
    #2
    The password is kept in encrypted form in database. Which could be easily accesible and decrypted in case the password is not strong enough.
    So first step towards security is choose a robust webhost.
    You can also try cloning script used in website lie Paypal,etc
     
    it career, Jun 2, 2007 IP
  3. wing

    wing Active Member

    Messages:
    210
    Likes Received:
    14
    Best Answers:
    0
    Trophy Points:
    58
    #3
    If your script is dealing with really sensitive stuff, encrypt sensitive information and consider using SSL.
     
    wing, Jun 2, 2007 IP
  4. stupidfly

    stupidfly Peon

    Messages:
    129
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #4
    How do you use the information after it has been encrypted? Is there like a key generated so you will be able to read what has been encrypted when you need it?

    What does it take to go SSL? Is it a whole new language? Does it cost money?

    Thanks for your input guys.
     
    stupidfly, Jun 2, 2007 IP
  5. ryanjparker

    ryanjparker Peon

    Messages:
    22
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    If it's that sensitive then maybe you shouldn't be storing it (ala sending CC info directly to payment processor instead of putting it into a DB).
     
    ryanjparker, Jun 2, 2007 IP
  6. wing

    wing Active Member

    Messages:
    210
    Likes Received:
    14
    Best Answers:
    0
    Trophy Points:
    58
  7. turiel

    turiel Peon

    Messages:
    148
    Likes Received:
    11
    Best Answers:
    0
    Trophy Points:
    0
    #7
    Also, check out this link:
    http://pajhome.org.uk/crypt/md5/auth.html

    Its a nice method so that you're never sending the password across the network. Usually, most login systems just make sure the plaintext password isn't stored in the DB but there's still a weak link whereby the plaintext password is sent over the network from the client browser to the server (unless you're using SSL, as described above). This method solves that problem, without using SSL.
     
    turiel, Jun 2, 2007 IP
  8. AstarothSolutions

    AstarothSolutions Peon

    Messages:
    2,680
    Likes Received:
    77
    Best Answers:
    0
    Trophy Points:
    0
    #8
    SSL for added security

    .Net's Form membership and roles provider is sufficient for most application, hash the passwords on the off chance the sql is compromised (again natively supported by .Net)
     
    AstarothSolutions, Jun 4, 2007 IP