security - Using AES to store passwords -


so need able decrypt password because old websites don't use oauth , need have of users have access them through there api. therefore 1 way hashing not work me. have been told best way store passwords aes , using salted hash of passwords key. how store keys , store salt? how implement this.

thank you

if understand correctly have following situation. users log in system username , password. system needs impersonate these users logging system not control using user's username , password system have given you.

if correct, might reasonable encrypt credentials other websites using aes. in case, not store key used encrypt crendentials. password user uses access system should used key, , should not stored anywhere. in way, have chance of protecting users privacy (depending on design of rest of system, of course).

since encrypting rather hashing, , encryption key differnet each user, salting not necessary.

also, encrypt full credentials, not passwords. users showing incredible amount of trust giving credentials in first place, possible justify trust!


Comments

Popular posts from this blog

WPF: binding viewmodel property of type DateTime to Calendar inside ItemsControl -

java - Getting corefrences with Standard corenlp package -

Java - Returning an array from a method to main -