Search code examples
phpsecurityhashpassword-recovery

Storing revertable authentication data


Sometimes stupid things come to mind but I'm wondering if you could share some insight on this situation.

Let's say I want to create a sort of service which is able to connect to a remote server (via FTP or something else). If someone would create an account for the service they would need to store their login credentials. Naturally you want to save the data secure and many topics on password hashing exist. But what if you need to use that password later? In this case; to connect to the remote host.

A real life example: I'm using the services of CodeAnywhere in case I don't have access to a computer with development software. This situation applies there as well.

The connection then goes from server A to server B. On server A stuff (files) are managed using server B. On server B an account is created to use the service from server B and a connection is made to server A, storing the authorisation data for server A.

Are people creating their own "hashing" rules to be able to store something like mypassword as drowsappym. In this example the password is reverted. But other things come to mind as well: use unicode points for each character, or create a mapping schema for each character (for example a=i,b=Q,c=*, and so on..). Of course you don't want to only secure the password, but all authorisation data.

Looking forward to the replies.


Solution

  • I would like to explain two ways that I would use.

    1. Use mcrypt_encrypt to store encrypt the password and later use mcrypt_decrypt to get the plain text password.
    2. If you are working with MySQL then you should have also a look at DES_ENCRYPT

    These are the fastest ways I guess and they also provide some pretty decent security, of course if someone breaks in your system then it can be a problem but it will also happen if you use RSA which is more complex to use as well.