You need to store a user in a database table; what do we need to know about them? (ie, email, password)
- To store a user in a databse we would need to know first and last name, email, passoword, and maybe a phone number.
- Depening on the application using the database it might require a mailing address, age, or other important attributes.
How can we store a password in a secure way? (ie, if our database is compromised, how can we protect their passwords from prying eyes)
- One way is by encrypting stored passwords with a nonreversible cryptographic function so an attacker could not solve the encryprion logic(if it were reversible).
- The use of salt, which generates two random hashes for a password, and increases the chances of the generated hash being unique to itslef. Salt forces password breaking software to restart everytime (for every password) a code is broken.