Like it or not, passwords form an essential part of nearly all user authentication systems, yet so many companies make basic mistakes when handling them. Often a password forms the only means of security for a user's account on multiple different websites so we all have a responsibility to handle this data properly.
During this talk I will go over some of the common mistakes people make surrounding password policies and elaborate on the golden rules for storing them securely.
and how to handle them
PHP North West, 2016
6 Rules of password storage
We must protect passwords not just for our own services security
but for the security of all internet services. Users reuse passwords,
in an ever connected internet, the value of a password is ever
We must not store plain text passwords because databases have a
habit of falling into the wrong hands.
We must not use reversible encryption because keys are required
all the time and have a habit of falling into the same wrong hands
at the same time as the database.
We must not simply hash the passwords. With a simple hash,
every password that is the same hashes to the same value an
attackers work to recover the passwords is therefore greatly
We must not use a hash which has been intentionally built for
speed such as Md5, Sha1 or Sha2. Dedicated hardware and GPU’s
can calculate Billions to TRILLIONS of hashes per second.
Password recovery by an attacker is inevitable.
We must use a hashing algorithm designed for password storage
such as PBKDF2, Bcrypt or Argon2i with appropriate cost
We may encrypt hashes.
Good password policies
Don’t disable copy + paste
Don’t force password expiry...
... Unless compromised
Don’t add complex requirements