Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Use bcrypt or scrypt to store the passwords. Don't use plain SHA1 or MD5, etc. If you must use SHA1 or MD5 (for whatever reason), iterate and salt them.

Edit: Re-reading, I may have mis-understood your question. You want to be able to decrypt and view their plain-text passwords yourself? Is that what you mean when you say "easy for me to decrypt". If that's the case and you need to decrypt it later (on their behalf) disregard my suggestions.



Yes, I will need the passwords in clear text when doing logins later.

I was thinking about storing the password as cram-md5, but that will require the server to support that. http://www.inter7.com/courierimap/INSTALL.html#crammd5




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: