0

My Oracle DB USER table has 3 columns:

USERNAME NAME LAST_LOGIN

However, I know need to store the user's password, i.e. add a fourth column, PASSWORD.

I'd like to encrypt the PASSWORD when inserting it into my DB's table.

How can I encrypt a single column? And, does this approach make sense?

  • 2
    Encryption means that you can decrypt the password. For that reason, passwords are virtually never encrypted. They are combined with a random user-specific salt and hashed. You verify the password by combining the provided password with the salt and checking whether the hash matches. That allows you to validate a password without ever being able to determine the password. Do you really want to store a hashed password? – Justin Cave Jul 28 '16 at 21:52
  • yes, I believe so. my app takes a user and pw and then uses a 3rd party websites service (that uses the username and pw) to authenticate. – Kevin Meredith Jul 28 '16 at 23:38
  • 1
    If you need to be able to pass the password to a third party to authenticate, then you wouldn't want to store a hashed password. Storing the actual password in a form that someone in your organization can decrypt is a terrible approach to security. I certainly wouldn't want to use a service that could decrypt my password. Are you sure that is your only option/ – Justin Cave Jul 28 '16 at 23:43
  • If you are just accepting a password from the user to validate with a third party site, why save it at all? Why not just authenticate, then drop the password from memory? Is this an interactive application? – Michael Keleher Jul 29 '16 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.