.png)
The Traditional Ways Of Storing A Password In A Server
Online security is a crucial step for any website on the internet. Due to the huge data of user’s personal information, sites remains in a state of constant theft.
Big companies like Facebook and Google uses highly protected security systems, that only the user of that account is able to access his/her account. They uses IP addresses and stored the information of the devices, which user use generally. They are improving their system day by day, which interact with the user when an abnormal activity appears.
As a Curiositor, I wonder how this security system works? So, I go through the internet and find some of the traditional ways a password is stored in a server. There are many ways, a password can be stored in a server and the simplest one is, just the plain text. Yup, nothing special here, probably the worst way to storing a password. If anyone gets into the server, it’s a child play for him/her to get all the information about the users.
So, the plain text isn’t the best way. Well to make the password more secure, developers move towards a process called encryption. It is a process in cryptography, in which a password is converted into a random string. If someone manage to get that string, he/she can’t understand it. So, the user data is secured. Definitely human are unable to understand the random strings because it won’t make any sense to them, and neither does to the computer or the server unless or until a decrypted key is given to convert the encryption into a plain text and here it is get worse, usually the decrypted key is on the same server where the encrypted passwords are stored. Its like a thief is trying to crack a lock and finds the keys in front of him. Not that secure anymore.
But don’t worry, developers have solved this problem, they don’t need decryption key or something that makes security weak. Now they use “Hash”. Nope, it’s not a drug. It is same process like encryption, but unlike encryption it’s a one way road. Whenever a user type the password, the hash uses the algorithm of making its encrypted string and then checks into the server for the same encrypted string of all accounts, when a match is found, it let the user to access his account. But then again, there is a small problem which can tend to be a big one. The “Algorithm” itself. What if someone knows, hows the algorithm work and makes all the random strings, which is almost impossible, but what if he got the power.
In that case, developer uses salt, which adds some more random string in the beginning and at the end, and even though if a person have the right formula of the algorithm, he or she will never finds out which part of the string is salt and which is hashed :)
Thank you for reading, here’s a security potato with some salt.
