Best/Easiest Way to save username and password data into a DB

[Pho3nix]

Hi,

As title states, looking for a easy but efficient way to make this work. Thoughts?
C# API for the moment that I'll be building on top of

 

[Messugga]

That depends. What database? In what way do you want to store the password? Plain text? Encrypted? Hash?
Best and easiest are often mutually exclusive. In my personal opinion, when it comes to security, best should have a significantly heavier weight than easiest.

 

[rrh]

Store the username and a [possibly encrypted] salted hash of the password. .NET has a stack of applicable classes.

 

[Pho3nix]

That depends. What database? In what way do you want to store the password? Plain text? Encrypted? Hash?
Best and easiest are often mutually exclusive. In my personal opinion, when it comes to security, best should have a significantly heavier weight than easiest.

Should be SQL if I still have credits on Azure, else AWS

Store the username and a [possibly encrypted] salted hash of the password. .NET has a stack of applicable classes.

Saw a few here and there. Figured I'd ask if anyone has used anything they like for actual reasons though.

 

[freddster]

Why don't you use the DB login and password? Then its the DBMS's problem.

 

[[)roi(]]

https://crackstation.net/hashing-security.htm

Example:

• http://stackoverflow.com/questions/2138429/hash-and-salt-passwords-in-c-sharp
• https://github.com/defuse/password-hashing

 

[skimread]

If you use C# don't reinvent the wheel, use Identity Framework

 

[zippy]

The "best" is dont save password in a db or anywhere, even if its "encrypted"

You can set up os authentication. There are many better secure alternatives.

 

[DA-LION-619]

If you use C# don't reinvent the wheel, use Identity Framework

+1

 

[AfricanTech]

The "best" is dont save password in a db or anywhere, even if its "encrypted"

You can set up os authentication. There are many better secure alternatives.

Any decent corporate will insist on this

 

[Hamster]

Any decent corporate will insist on this

Have I got news for you...

 

[Kosmik]

Have I got news for you...

Lol,true.

If it's domain, use AD authentication libraries.

 

[AfricanTech]

Have I got news for you...

I did say decent...

 

[Hamster]

I did say decent...

You haven't seen my CV

 

[AfricanTech]

You haven't seen my CV

:crylaugh: