CODEWITHSUNDEEP
asp.netasp.net-membership
andleer
andleer

Reputation: 22568

Storing Account / Passwords

I am working on a web based application that will need to store usernames and passwords. Account information will be needed to perform secondary authentication on behalf of users so I can't simply store usernames and passwords using one-way hashing with salt etc.

Assuming that my basic requirement can't change, any suggestions on how to handle the storage of these accounts? Symetric Encryption using the machine key? Using a random key in web.config? Using SQL based encryption?

Upvotes: 1

Views: 235

Answers (3)

Joel Coehoorn
Joel Coehoorn

Reputation: 415620

The best practice here is to not ask for this information until the moment you pass it on to the external provider. Then only keep the external provider's authentication token, such that you only need to ask for credentials again at points where the external resource would require them if the user were accessing it directly.

Upvotes: 1

Mike Marshall
Mike Marshall

Reputation: 7850

The SqlMemebershipProvider has everything you need. There is even a built-in app that comes with .NET that will prep your DB.

Here is the MSDN page on the db prep tool

Upvotes: 1

Daniel A. White
Daniel A. White

Reputation: 190907

Why don't you use the builtin MembershipProviders? http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx

Upvotes: 4

Related Questions