Passwords are credentials used with usernames to authenticate users. They are valuable targets: a database breach can expose accounts on the application and enable attackers to try reused credentials elsewhere. Never store a password in plain text; store only a value derived with a strong password-hashing algorithm, plus salt and pepper. section 3.8 section 3.11
A password defense should address both theft and guessing:
- Hash passwords before storage so a leaked database contains hashes rather than directly usable passwords. section 3.8
- Use a strong algorithm such as bcrypt; older algorithms such as MD5 are weak. section 3.8
- Treat username-and-password-only login as risky because attackers can rapidly test stolen username and password lists with brute-force tools. section 8.1
- After a suspected credential breach, clearly tell users what may have been exposed and require password rotation when credentials might have been stolen. section 15.5
Checking a password without storing it
When a user logs in, hash the newly entered password using the stored salt, then compare that result with the stored hash. A match verifies the password without retaining its plain-text form. section 3.8
require 'bcrypt' include BCrypt::Engine password = "my_topsecretpassword" salt = generate_salt hash = hash_secret(password, salt) #1 password_to_check = "topsecretpassword" if hash_secret(password, salt) == hashed_password #2 puts "Password is correct!" else puts "Password is incorrect." end
The Ruby bcrypt listing illustrates generating a salt, hashing a password, and checking a later entry by hashing it again for comparison. section 3.8
