[Pharo-project] How to encrypt a password?
Hi guys. I need to be able to store a password as part of a method. Say I need to be able to do 'thisIsMyPassword' encrypted -> 'dasdafjewrhjk34wh5435345345345ewfsfs' Then I can write the method: MyClass >> myPassword ^ 'dasdafjewrhjk34wh5435345345345ewfsfs' decrypted It should have a kind of public key somehow so that someone cannot easily decrypt it. How can I do that in Pharo? I am totally newbie with all this stuff. Thanks, -- Mariano http://marianopeck.wordpress.com
Someone may have already replied as I am writing this on a plane but generally for passwords you do not write a decrypt method for security purposes (eg you do not want people to be able to reverse engineer the encrypted password easily) You just compare encrypted passwords to see if they are equal. eg password:= SecureHashAlgorithm new hashMessage: aClearTextPass. then later on you check password = SecureHashAlgorithm new hashMessage: aPasswordAttempt. On Oct 24, 2011, at 11:44 PM, Mariano Martinez Peck wrote:
Hi guys. I need to be able to store a password as part of a method. Say I need to be able to do
'thisIsMyPassword' encrypted -> 'dasdafjewrhjk34wh5435345345345ewfsfs'
Then I can write the method:
MyClass >> myPassword ^ 'dasdafjewrhjk34wh5435345345345ewfsfs' decrypted
It should have a kind of public key somehow so that someone cannot easily decrypt it.
How can I do that in Pharo? I am totally newbie with all this stuff.
Thanks,
-- Mariano http://marianopeck.wordpress.com
On 25 October 2011 04:43, mail list <mail.list@ficonab.com> wrote:
Someone may have already replied as I am writing this on a plane but generally for passwords you do not write a decrypt method for security purposes (eg you do not want people to be able to reverse engineer the encrypted password easily)
You just compare encrypted passwords to see if they are equal. eg password:= SecureHashAlgorithm new hashMessage: aClearTextPass.
then later on you check password = SecureHashAlgorithm new hashMessage: aPasswordAttempt.
To make it slightly more secure, you can put a little salt in it: salt := 'Some random string I just cam up with 123' password:= SecureHashAlgorithm new hashMessage: salt, aClearTextPass. check: password = SecureHashAlgorithm new hashMessage: salt, aPasswordAttempt. That way you make it more difficult for the attacker to brute-force guess the password when the user supplies a weak password. -- Milan Mimica http://sparklet.sf.net
Thanks for your answers, I am learning. Alexandre On 25 Oct 2011, at 03:40, Milan Mimica wrote:
On 25 October 2011 04:43, mail list <mail.list@ficonab.com> wrote: Someone may have already replied as I am writing this on a plane but generally for passwords you do not write a decrypt method for security purposes (eg you do not want people to be able to reverse engineer the encrypted password easily)
You just compare encrypted passwords to see if they are equal. eg password:= SecureHashAlgorithm new hashMessage: aClearTextPass.
then later on you check password = SecureHashAlgorithm new hashMessage: aPasswordAttempt.
To make it slightly more secure, you can put a little salt in it:
salt := 'Some random string I just cam up with 123'
password:= SecureHashAlgorithm new hashMessage: salt, aClearTextPass.
check: password = SecureHashAlgorithm new hashMessage: salt, aPasswordAttempt.
That way you make it more difficult for the attacker to brute-force guess the password when the user supplies a weak password.
-- Milan Mimica http://sparklet.sf.net
-- _,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;: Alexandre Bergel http://www.bergel.eu ^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;._,.;:~^~:;.
participants (4)
-
Alexandre Bergel -
mail list -
Mariano Martinez Peck -
Milan Mimica