Hashed passwords

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Ben Bloom - 04 Aug 2004 16:28 GMT

OK, so I'm sending hashed passwords back and forth and it's cool. I
want to store the hashed password in my database, for obvious security
reasons (well, obvious now that I've read about them!)

What's the best way to go about putting the hashed password in for an
account? I assume I should make a password generator that accepts a
username/password (& whatever other details I need - company,
active/inactive, etc), hashes the password, and inserts it into the
database.

What hash method do I use so it matches up with the WSE hashed password
in the SOAP message?

Thanks!
-Ben

Reply to this Message

Softwaremaker - 04 Aug 2004 21:48 GMT

Hi Ben,

I have blog on something like this here.
Real World UsernameToken Authentication Scenarios with WSE2.0 RTM
http://dotnetjunkies.com/WebLog/softwaremaker/archive/2004/06/10/16012.aspx

hth.

Signature

Thank you very much

Warmest Regards,
Softwaremaker
Architect | Evangelist | Consultant

+++++++++++++++++++++++++++++++++

> OK, so I'm sending hashed passwords back and forth and it's cool. I
> want to store the hashed password in my database, for obvious security
[quoted text clipped - 11 lines]
> Thanks!
> -Ben

Reply to this Message

Ben Bloom - 04 Aug 2004 22:09 GMT

> Hi Ben,
>
[quoted text clipped - 3 lines]
>
> hth.

Thanks again Softwaremaker. I'll have to give this a more thorough
reading tomorrow. Looks like a very practical writeup.

-Ben

Reply to this Message

Jag - 05 Aug 2004 00:54 GMT

Encrypting the username token using the public key of the server ensures
that the password is encrypted in the request to the server. What happens
when the response from the server is sent to the client ? I have looked athe
the trace the output tace at the client has no password in clear text. But
the input trace on the client has a clear text password. Can somebody help
with this. ( I am using a policy file to encrypt the password
<wssp:Confidentiality><wssp:MessageParts> tags.)

Regards
Jag

> > Hi Ben,
> >
> > I have blog on something like this here.
> > Real World UsernameToken Authentication Scenarios with WSE2.0 RTM

http://dotnetjunkies.com/WebLog/softwaremaker/archive/2004/06/10/16012.aspx

> > hth.
> >
> Thanks again Softwaremaker. I'll have to give this a more thorough
> reading tomorrow. Looks like a very practical writeup.
>
> -Ben

Reply to this Message

Softwaremaker - 05 Aug 2004 21:31 GMT

Hi Jag,

I have responded to your email and query here.
http://dotnetjunkies.com/WebLog/softwaremaker/archive/2004/08/06/21271.aspx

hth.

Signature

Thank you very much

Warmest Regards,
Softwaremaker
Architect | Evangelist | Consultant

+++++++++++++++++++++++++++++++++

> Encrypting the username token using the public key of the server ensures
> that the password is encrypted in the request to the server. What happens
[quoted text clipped - 11 lines]
> > > I have blog on something like this here.
> > > Real World UsernameToken Authentication Scenarios with WSE2.0 RTM

http://dotnetjunkies.com/WebLog/softwaremaker/archive/2004/06/10/16012.aspx

> > > hth.
> > >
> > Thanks again Softwaremaker. I'll have to give this a more thorough
> > reading tomorrow. Looks like a very practical writeup.
> >
> > -Ben

Reply to this Message

Hashed passwords

Free Magazines