Converting plain text into the mysql database using php and getting it back when required as plain text

Question

I am designing a web app where we require to take some credentials from users to access few websites like (Equfax etc.. )

I know that saving these credentials in plain text is a bad idea. But we need the back end team to get the password for the business process.

How can retrieve the Hashed password and display it as plain text ?

If this doesn't work, then I guess i can use a PDF form to get the details and save the file as a blob in mysql and download it when required. But, still I know this a risk if the database is stolen.

Let me know, If I have a solution for this.

Thank you for reading this.

Simon Deconde · Accepted Answer · 2016-02-23 03:35:24Z

1

Yes indeed you would need to encrypt these passwords if you store them anywhere on your server (database, text file, RAM... anywhere). Now, the tricky part is that if your app can decrypt these passwords by itself, then anyone who breaks into your server will be able to do the same by reverse-engineering your code.

The only way to prevent that is to use an encryption key made of two separate components: - a server key, stored in your app's code - and a user key that the back-end team will input in the app (upon login for example).

Eg: $encryption_key = $server_key . $user_key;

$encrypted_password = your_encryption_function($key, $value_to_encrypt);
$decrypted_password = your_decryption_function($key, $value_to_decrypt);

The $user_key would then be input by your back-end staff member before being able to decrypt/encrypt the passwords. That key would have to be shared across all back-end staff members.

Potentially, you could also salt each password to add a third component to the encryption key.

$encryption_key = $server_key . $user_key . $password_salt;

answered Feb 23, 2016 at 3:35

Simon Deconde

3191 silver badge4 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Geeky Bird Over a year ago

Thank you Simon.. I will look into this :)

Collectives™ on Stack Overflow

Converting plain text into the mysql database using php and getting it back when required as plain text

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related