Search code examples
mysqlsecuritypassword-protection

Store password separately from username

I have recently done an overview of my site security following the recent news articles around the high profile websites being hacked eg. LinkedIn

So my question is:

How is it possible to store a user’s password completely separate from their username and other information? This way a hacker could only potentially get a password and not the corresponding username.

Edit: I forgot to say that I'm already storing the passwords as a hash (and salting it).

Solution

  • No matter how you do it, there still needs to be a way for the authentication mechanism to tie the username/password together, so what you're seeking to do is futile.

    Rather than going that route, you should be storing your passwords as Hash value that can't be decrypted, which is the accepted best practice.

    http://blog.moertel.com/articles/2006/12/15/never-store-passwords-in-a-database