Plateforme Level Extreme
Abonnement
Profil corporatif
Produits & Services
Support
Légal
English
Encrypting password column in a table?
Message
De
20/08/2004 01:44:48
 
 
À
19/08/2004 13:34:32
Information générale
Forum:
Visual FoxPro
Catégorie:
Codage, syntaxe et commandes
Divers
Thread ID:
00933970
Message ID:
00934765
Vues:
23
One drawback to this whole approach is that the key value, "Whateveryoulike" is stored in your app and is vulnerable to being extracted by decompilation tools.

In some cases, what people want is for users to enter a user name and password to be allowed to use the app; if they're not right, they get kicked out. In this case, IMO a better approach is to store cryptographic "digests" of the user name and password, using a "hash" function like MD5. These hash functions are pretty secure; even if a hacker decompiles the digest values (or reads them from a VFP table) it is virtually impossible to determine the userid or password strings that originally created the digests. Pseudo-code would be something like this:
lcUserID = "MyUserID"
lcPassword = "MyPassword"

lcUIDDigest = MD5Hash(lcUserID)
lcPWDigest = MD5Hash(lcPassword)
* Above two values can be embedded in your app as variables or constants,
* written to table fields etc.

* Check if user is authorized:
* lcKeyedUserID, lcKeyedPassword are values that user keys in when your program starts

IF MD5Hash(lcKeyedUserID) = lcUIDDigest ;
  AND MD5Hash(lcKeyedPassword) = lcPWDigest
  * Authorized

ELSE
  * Not authorized - retry, kick 'em out, etc.

ENDIF
For implementation of MD5, check out Re: Hash() Function in VFP Thread #713481 Message #714561

>The VFP guru otherwise known as Sergey set me straight. Now I am using this approach which is much better:
>
>
>* Get the cipher50.fll file from the below url:
>* http://www.levelextreme.com/wconnect/wc.dll?FournierTransformation~2,54,33,9222
>
>IF NOT 'CIPHER50' $ UPPER(SET('library'))
>   SET LIBRARY TO cipher50.fll
>ENDIF
>
>lcText = "ABA"
>lcEncryptKey = "Whateveryoulike"
>
>? "Base Value: ", lcText
>? " Encrypted: ", encrypt(lcText, lcEncryptkey)
>? " UnEncrypt: ", encrypt(encrypt(lcText, lcEncryptkey), lcEncryptKey)
>
>
>>Tom,
>>
>>I'm not aware of FoxCrypto.FLL, but the name Base64 means something to me. Isn't waht you're doing below the same as StrConv (cExpression, 13) and StrConv (cExpression, 14) ?
>>
>>Regards,
>>
>>Fernando
>>
>>>Here is the solution I came up with:
>>>
>>>
>>>
>>>* Get FoxCrypto.FLL at http://www.connectthenet.com/foxpro/FoxCrypto.fll
>>>
>>>
>>>SET LIBRARY TO FoxCrypto.FLL
>>>LOCAL lnHandle
>>>CLEAR
>>>lcBuffer = "Testing"
>>>? "     Base Value: ", lcbuffer
>>>
>>>lnHandle = Base64encoderCREATE( .F. )
>>>IF lnHandle > 0
>>>    Base64encoderPUT(lnHandle, lcBuffer)
>>>    Base64encoderCLOSE(lnHandle)
>>>    lnSize = Base64encoderMaxRetrievable(lnHandle)
>>>    lcBase64Encoded = Base64encoderGET(lnHandle, lnSize)
>>>    ? "Encrypted Value: ", lcBase64encoded
>>>    Base64encoderDestroy(lnHandle)
>>>ENDIF
>>>
>>>lnHandle = Base64decoderCREATE()
>>>IF lnHandle > 0
>>>    Base64decoderPUT(lnHandle, lcBase64encoded)
>>>    Base64decoderCLOSE(lnHandle)
>>>    lnSize = Base64decoderMaxRetrievable(lnHandle)
>>>    lcBase64decoded = Base64decoderGET(lnHandle, lnSize)
>>>    ? "Decrypted Value: ", lcBase64decoded
>>>    Base64decoderDestroy(lnHandle)
>>>ENDIF
>>>? "Matches = ", lcBase64decoded == lcBuffer
>>>
>>>
>>>
>>>
>>>
>>>>>I have a DBF that contains a user userid and password. I would like to encrypt the password column and be able to still use its value as normal. What is the best most straightforward way to do this without purchasing a third party product?
>>>>
>>>>Would it be possible to store hashes of those values, rather than the values themselves?
Regards. Al

"Violence is the last refuge of the incompetent." -- Isaac Asimov
"Never let your sense of morals prevent you from doing what is right." -- Isaac Asimov

Neither a despot, nor a doormat, be

Every app wants to be a database app when it grows up
Précédent
Répondre
Fil
Voir

Click here to load this message in the networking platform