Securing passwords and other sensitive information is not new to anyone. But the approach of how to secure and handle those information in your application seem to differ across many developers. I have seen in some places, passwords being Base64 encoded so that it is convenient for QA or support folks to troubleshoot or provide back door support to their clients. In some other places, they were doing 3DES encryption but within application they were decrypted to plain text. Even worse, a minor section of folks had it in clear text all over.
Security is a cross cutting concern, meaning these sensitive packets need to be encrypted the moment they leave user view space and maintained in the same form during transmission, reception, processing, and storage. It should not be decrypted at any stage, not even by your application (since those may end up in some log file).
The most common form is MD5 one way hashing where you cannot recover the original message. However, developers need to keep in mind this type of encryption has dependency on OS address space, i.e 32-bit or 64-bit and applied character encoding. You may not be able to produce a matching MD5 output when one of your app produces MD5 on 32-bit and another app validates MD5 of the same text using 64-bit.
No comments:
Post a Comment