storing passwords in sql server database using ef core code first

Question

I have this class to represent my users:

public class User
{
    public int ID {get; set;}
    public string UserName {get; set;}
    [DataType(DataType.Password)]
    public string Password {get; set;}
}

A simplistic version of my register method looks like this:

[HttpPost]
Register(User newUser)
{
    ...
    _context.add(newUser);
    await _context.SaveChangesAsync();
    ...
}

So my question is: Should I alter the password type from a regular string before storing? If so, to what data type?

BradleyDotNET · Accepted Answer · 2018-10-09 17:30:40Z

7

YES YES YES

Never store passwords as plain text

While much of this is a security discussion rather than a programming one, you should only be storing a secure hash (PBKDF2, Argon, and Bcrypt are current standards) along with a unique salt used for that hash.

Storing it as you are is just asking someone to steal your database and get all your users passwords without any more effort than reading the Password column (which they probably reused a million other places).

Its still OK to store it as string though.

The DataType.Password is just an annotation for consumers of your class to read. (per https://msdn.microsoft.com/en-us/library/system.componentmodel.dataannotations.datatype(v=vs.110).aspx). It does not enhance security from a storage/database perspective.

edited Oct 9, 2018 at 17:30

answered Mar 6, 2017 at 20:03

BradleyDotNET

61.5k10 gold badges106 silver badges124 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

tocoolforscool Over a year ago

So does the DataType(DataType.Password) annotation for the class property not encrypt or hash the password at all?

Tim · Accepted Answer · 2017-03-06 23:03:23Z

1

You should never store a password in the database if you can avoid it. Best practice is to store a salted, irreversible hash of the password.

Typically this would be a SHA2 or PBKDF2, or whatever of the password salted with something that cannot change about the user-- e.g. the ID of the record.

You would store the has typically as a varbinary(32) or whatever length your hash algorithm uses.

This approach means that you cannot determine a user's password, since it is irreversible. To test a password of someone attempting to login, perform the same hash with the same salt, and test if the result is the same as what you have in your database. This way, a hacker who gets your database cannot figure out what each user's password is, but you can still test if a user knows their own password.

edited Mar 6, 2017 at 23:03

answered Mar 6, 2017 at 20:06

Tim

6,0681 gold badge16 silver badges19 bronze badges

4 Comments

tocoolforscool Over a year ago

What does DataType.Password DataAnnotation do for the property then?

BradleyDotNET Over a year ago

The problem with MD5/SHA1 is not necessarily collisions (though that is a problem), its that they are easily crackable with consumer hardware. PBKDF2, BCrypt, SCrypt, etc. are designed to be slow so brute-force attacks are much harder (often requiring specialized FPGAs)

BradleyDotNET Over a year ago

See security.stackexchange.com/questions/19906/… for more

Josh Wright Over a year ago

I desperately added a bunch of tags to posts just to get to 50 rep so I could stick a comment on this post saying how bad of an idea it is to use MD5 etc for passwords, but BradleyDotNET beat me to it. I still want to reiterate that it's a terrible idea.

Collectives™ on Stack Overflow

storing passwords in sql server database using ef core code first

2 Answers 2

Never store passwords as plain text

1 Comment

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Never store passwords as plain text

1 Comment

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related