How to store passwords in database securely?

Question

I have read that one way to store passowrds in a database is by the following way. To have a database table with columns username, hash and salt. The salt would never be shown.

I generate the hash with password + salt. The password is send by the user and is not stored in the database. If the generated hash is the same as that stored in the database, the password is correct.

But I have my doubts. If I send the password, it could be sniffed while it is transmitted by the wire, so I think that it is neccesary to encrypt the communication too. So using a hash and salt is only to protect the data from the administrator? I mean that if I store the password in database, an administrator could easily access all information. If I store the hash, the administrators can't access to the information of users becasue the administrator don't have the half of the information, only the salt and not the password. However, while the user need to send the password, this could be sniff by someone, so the password is exposed.

How is the best way to protect the information of the user?

Thanks.

Answer 1

Hashed passwords also protect your data from outsiders. Imagine, if someone accessed your data using a SQL injection he would only get a hash & not the pass. You can use HTTPS for secure communication over your network & use your existing table of hashed passwords for a good security model. Secure salted password hashing

Answer 2

If you have to transmit the password in clear then you must protect it in transit. From browser to http server you need SSL/TLS. From application server to database you need encrypted connections.

There are schemes that don't require the transmission of password, the best know being HTTP Digest. You can store Digest's HA1 part in the database. The realm secret and user name contained in the HA1 digest contain as an effective protection against rainbow tables, but the fact that Digest is still based on MD5 makes the scheme relatively weak against a sufficiently well equipped brute force. However such a brute force would only reveal a colission that is specific to the given user name and realm, thus making it of very little use.