[RESOLVED] Password Table

[Liquid Metal]

I have seen some applications where they store username and password into a table. Would you agree this is not the ideal practice?

I use AD to check for permission. I tried to avoid storing users' passwords in a table.

Is there ever a need to store users passwords in a table in terms of design wise?

[si_the_geek]

If you have the option, using something like AD is a very good idea, but unfortunately there are times when that isn't possible - such as when users are connecting to the database via a web site.

This site is a good example of that, and is a case where a table with login details is needed. However, I would expect that the details are not stored in plain text, and instead are encrypted or hashed.

[Liquid Metal]

That makes sense Si_The_Geek.

I was refering more for intranet applications but you made a good point and pointed out that a password table is required for internet applications.

Hmmmm...That is where CVMichael's encryption string function comes into play.

[si_the_geek]

I have seen Intranet systems where AD or similar can't be used (due to network problems), but would always use it if possible.

In terms of security, I would recommend hashing (which cannot be reversed to get the original value) rather than encryption (which can be reversed, if you know how it was done).

[Liquid Metal]

Got it!

Thank You

[CVMichael]

I just saw my username is mentioned here....

I think this should help you:
VB6 - Example on how to make a Login where password is stored hashed in Database

[Liquid Metal]

I been looking for something like that for a while CVMichael. I am going to examine it more in detail tonight. If I have any questions, I will post to the original thread. Here is a 3-eyed frog for you.