Menu
As per question, is it safe to store passwords on php pages such as
$password = 'pa$$w0rd'; If the users can't see it, it's safe, right?
EDIT: Some people actually suggested using hash, however, there would be a problem with database server connection password, wouldn't it?
801
Solutions for secure storing and sharing passwords First and foremost, make sure that storing and sharing passwords in plain text is no longer your (and your colleagues') habit. Instead, build some new ones! For storing passwords, forget all those sheets, notepads and Sticky notes – use encrypted password storage.
If you're thinking this is useless, think again – it's a highly secure way to save passwords when you don't actually want to know what the password is in plain text. For more advanced protection, PHP has a complete encryption system capable of locking out even the most capable hackers.
Yes. You can choose to store your derived key in the session knowing it might be compromised if the server is compromised, but at least the users's password is still safe.
It is safe. That's how the entire web works. All passwords in forms are always sent in plain text, so its up to HTTPS to secure it.
The short answer is both No, and It Depends.
It's almost never a good idea to store passwords in plain text, especially in a web accessible location, if for no other reason than a simple server misconfiguration or an echo in the wrong place could expose it to the world.
If you MUST store a password, (which is possible) you could try to store it outside the webroot, eg /var/www/public_html/ Put your codez here/var/www/includes/ Put your passwords here
Even better than that would be to have the system that you need the password for (eg a database wrapper ) return an object already instantiated. so rather than asking for $databasepassword you ask for a PDO object, and store your database classes outside the webroot.
The It Depends comes from what attack vectors would cause someone to have access to that password text, and would it require them to be already inside your filesystem, if so, you're probably screwed anyway.
Also, if its the password to your supa-secrit subscriber content, meh, all you've lost is some subscription fees, if its your database, you may have a problem, if it's your online banking details, um good for you.
How valuable is the thing the password is protecting?
183
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
