Current Password storage
Ok, I have a basic idea how passwords are stored. Here is the way I think they are stored.
Passwords are stored in a database in a hashed form. The downside is that if the database is leaked or hacked a hacker could use brute force or a rainbow table to figure out the passwords. To get around this, you can use a salt the hashes to have it more difficult to brute force the password. The salt is used with the password to form the hash.
So As I understand it the database would be set up like this.
Username(key) - Hash(password + salt) - Hash used (randomly generated)
The problem with this method it is still susceptible to offline hacking.
My Idea
What if we use the combination of the username and password to create the database index/key.
So the database would look like this
Hash (username + password, key) - Hash1 (salt + password) - hash2 (username + salt) - Salt (randomly generated) -
At a bonus you can fill the table in the database with random data. If the database is leaked the offline hacking would be virtually impossible.
If the database gets leaked it would be infeasible to figure out both the username and password. Both the username and password are used to create hashes to make sure false positives do not happen or extremely unlikely to occur.
What do you guys think?
submitted by [comments]
SOCIAL SHARE CARD GENERATOR