在数据库上存储用户的数据库密码。 使用应用程序用户密码作为加密的好方法吗？

Question

The application is not finished yet, and for now the passwords and databases information is just encrypted in the database, and decrypted on the application with a key.

But I was thinking, if I could save the database information on an encrypted table, one entry for each combination of user-database, and such information is encrypted using the hashed user password as salt (not the same hash as in the users table, of course). So if an attacker somehow manage to get his hands on the database or the application it still couldn't read all the databases passwords, because it would need the password of an user with access to such database.

And my idea was that when the user logs in, his password is hashed (as in the database salt), and saved as a cookie with a short lifespan to use it while the user is connected.

Although I was thinking, if the attacker gains execution on my application, he could still have access to the cookies of connected users with each request.

The other drawback is that the user couldn't reset the password, because if he did he couldn't decrypt the password to access the databases.

So, what are your thoughts of this? Is this a good approach? What would you do?

Answer 1

There is a misconception here. Cryptography alone cannot protect your entire business/company/data.

When you encrypt a data and users always decrypt and use those data, you cannot relay on it, because if you let a hacker get access to your server, hacker will be able to decrypt data like other users.

For protecting data you have to take other measures, measures like:

• Analyzing your web application code, prevent all type of SQL injections, code executions, LFIs, RFIs, XSSes, etc.

• Analyze your database access list. Do not let your database server become accessible for foreign IPs, even if user knows username/password. Protect databases with proper access lists. If most parts of pages doesn't enter data in tables and just do select query, ONLY grant SELECT permission to a user and define this user/pass for SQL queries.

• Always keep your server softwares update. It could be Server OS, web server app or web app itself.

You can protect your data/server with above methods, I don't think overally encrypting always in use users database being encrypted is a good idea. It will reduce the speed/performance and will not help you to prevent from being hacked.