Properly transmitting and securing users' passwords for a web app

Question

I'm working on a web app for my Masters project. It's a system for professors to manage student projects, and it uses Java for the server-side code, HSQLDB for the database, and JSPs for the presentation layer, and it runs on tomcat. The data that will be stored doesn't include any sensitive information (student ID, financial info, nothing like that) but usernames and passwords are a requirement, so I want to protect the passwords themselves in the event that a student uses a password for my app that they use for some other, more important app (this will undoubtedly happen even if I tell people not to do it).

I've never looked into this kind of thing before and I'm pretty lost. I did find a good article explaining how to use Java to create a hash of a password, and I found info in the tomcat documentation explaining how to set the hash scheme being used in realms and how to do SSL with tomcat, as well as a JavaScript library to create hashes from passwords, but I'm not sure how to put all the pieces together, and what pieces I need exactly.

If I use the JavaScript library to hash the password and use SSL for the login step (it's unnecessary after that I think since the other data doesn't need protecting), then store only the hashed versions of passwords in the database, is that sufficient? Or do I need to do something more? I ran across a question where answers discussed PBKDF2 and some other things, but it just confused me more... If I should use one of the schemes mentioned in those answers, how do I go about doing it? I haven't seen references to them in tomcat or other documentation so I don't know how I'd use them...

If anyone can clear up my confusion and tell me what the correct way to securely transmit and store passwords is, I would really appreciate it.

Answer 1

SSL takes care of securing the entire transport layer. You don't need to worry about data that is sent over HTTPS.

Never store real passwords in your database. Only store salted hashes made with appropriately secure (i.e. not MD5) hash functions. Use a different salt for each hash.

If you follow these principals, no matter what components you use, you will have a reasonably username/password storage mechanism.