from localhost (jalapeno [127.0.0.1])
	by jmason.org (Postfix) with ESMTP id 7C6BB16F69
	for <jm@localhost>; Tue,  3 Sep 2002 17:20:19 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Tue, 03 Sep 2002 17:20:19 +0100 (IST)
from outgoing.securityfocus.com (outgoing2.securityfocus.com
    [66.38.151.26]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id
    g83G4ZZ26141 for <jm@jmason.org>; Tue, 3 Sep 2002 17:04:36 +0100
from lists.securityfocus.com (lists.securityfocus.com
    [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id
    326048F2CD; Tue,  3 Sep 2002 09:00:08 -0600 (MDT)
From dwheeler@ida.org  Tue Sep  3 17:20:20 2002

If you need to store a database password, then
clearly the first step is to store the text outside the
web tree.  You can encrypt it and store the encryption key elsewhere,
so that at least an attacker has to get two different things.
Also, don't get full privileges - create a user account that
However, you can often do better than this if security
is critical.  Create a separate program which has these
database keys (as noted above), and make the web program
contact IT.  Create a very limited protocol that ONLY
lets you do the operations you need (you can add specific
operations later).  There's a performance hit, which you're
> On Fri, Aug 23, 2002, David Wheeler wrote:
>>The standard way to store passwords is... not to
>>store passwords.  Instead, store a salted hash of
>>the password in a database.  When you get a purported
>>password, you re-salt it, compute the hash, and
>>determine if they are the same.  This is how
>>Unix has done it for years.  You want bigger hashes
>>and salts than the old Unix systems, and you still want
>>to prevent reading from those files (to foil password crackers).
> Well...but this cannot be applied to database password, which most
> web apps use. The only solution I figure is store in clear outside web

from localhost (jalapeno [127.0.0.1])
	by jmason.org (Postfix) with ESMTP id A3EC416F56
	for <jm@localhost>; Tue,  3 Sep 2002 17:20:21 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for jm@localhost (single-drop); Tue, 03 Sep 2002 17:20:21 +0100 (IST)
from webnote.net (mail.webnote.net [193.120.211.219]) by
    dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g83G5AZ26175 for
    <jm@jmason.org>; Tue, 3 Sep 2002 17:05:10 +0100
from outgoing.securityfocus.com (outgoing2.securityfocus.com
    [66.38.151.26]) by webnote.net (8.9.3/8.9.3) with ESMTP id RAA02213 for
    <jm@jmason.org>; Tue, 3 Sep 2002 17:05:24 +0100
from lists.securityfocus.com (lists.securityfocus.com
    [66.38.151.19]) by outgoing.securityfocus.com (Postfix) with QMQP id
    145628F2CC; Tue,  3 Sep 2002 09:00:05 -0600 (MDT)
From ygingras@eclipsys.qc.ca  Tue Sep  3 17:20:22 2002