Requesting and hiding passwords

[crom]

I would appreciate a pointer to any advice on handling passwords:
- asking for a password (inputbox, textbox, other)
- hiding the password as it is typed
- encrypting the password in a password file
(Sorry - newbie)

 

[zekeman]

1. The form control textbox has a property named password char

2. See above

3. ??

 

[vis781]

You can hash a password and store it in just about any file, .txt/xml/registry etc. If you hash the password that they choose then it won't be possible for anyone to just open the file and read it.The only thing is that you will have to hash every password they use when they login and compare it against the stored hashed password. Theres a link below that explains a bit about hashing.




http://www.obviex.com/samples/hash.aspx

 

[JohnH]

If you hash the password it can't be retrieved again, it can then only be compared for verification if user input password again. So in effect the application is not storing the password.

There are several classes in System.Security.Cryptography that will allow to encrypt/decrypt. There is an example for the RijndealManaged class here http://msdn2.microsoft.com/en-us/library/system.security.cryptography.rijndaelmanaged.aspx (Remember to store the key/iv, these are the unique keys/salt that enable you to decrypt previously encrypted data.)

 

[crom]

Thanks everyone. I have now implemented a facility using dialogbox/textbox.passwordchar and it works just fine. I'm now reading up on your hash links so I can protect the password file.

One small query: I can't use the big blob (chr(249)) to conceal my passwords as a foreign symbol appears instead. An asterisk is OK though.

 

[vis781]

If you hash the password it can't be retrieved again, it can then only be compared for verification if user input password again. So in effect the application is not storing the password.

Maybe i've mis-understood your post, but the impression i get is that you think that using hashing is not a good way to 'conceal' passwords. I personally always use this method for access to sensitive imformation because of the fact that it is 'one way' Using cryptography in the .net framework is ok but it is easier to 'get a hold' of the password if some unscrupulous wanted to do so. I don't want passwords to be retrieved again once they are entered just, as you say, provide a way to compare the entered password and the stored one.

 

[JohnH]

vis781, that depends upon if you want a 'remember my password' feature for the application or if you just want it to lock in on a user that must always log in manually. Two altogether different features - and neither exclusive to croms request. But if you choose to hash the password the same data can't be used to 'auto-login' since application then don't know the password.

 

[vis781]

'Remember My Password' i'd not thought of doing that... Mmmm, food for thought.