Just a few words more:

Being a true administrator means that you have the power to do whatever you see fit with the data _and_ with the database. (Doesn't mean you have to or you are welcome to :) )
So any means of protection against the administrator itself is (almost) nonsense.
The best you can get in this direction is encryption at user side, or at server side (using Sudhi's suggestion).
However, for password storage you might want to consider the classical method using non-invertible functions: The plain-text password gets transformed with a one-way function into a non-readable string (hash). This string gets stored into the column. When you want to authenticate a user, get the plain-text password, apply the function and compare the result with the database column. If the function is really non-invertible then not even the administrator will be able to find out the actual plain-text password from the hash (even though he will still be able to circumvent the purpose of the scheme itself by making use of its privileges).
Beware, in the above text "hash" might not be similar in meaning to the hash as in "dbms_utility.get_hash_value".

Yours,
F.

One other option you could use is to rename the table with the password column to something else, then create a view with the same name as the original table and a "where" clause that allows each login to see its own row only.  If you do this, make sure you grant select and update on the view to public, and revoke all grants to the base table.  (It may be better to go with the encryption suggestion, but this may be quicker to implement.)

Hi,

You can use the DBMS_OBFUSCATION toolkit as specified by Sudhi or you can custome build one for you. Something like converting the each character to ASCII value and adding a constant etc .. so that if someone sees the data also, they will not be able to know the password. Also, you application programs should not decrypt rather try to encrypt the password keyed in the user and validate with the one stored in the DB. In this way, the password is never revealed. You can write a stored procedure for encrypting the password and use it in your application. Hope this helps.

BTW, Which version of Oracle are you using? The above mentioned DBMS_OBFUSCATION toolkit will work only from Oracle 8i.

Let me know if you need more help

Regards,

Sarada Priya

Hi tvspriya!

Seems you're new around, so maybe you'll want to take a look at the "more tips on Comments and Answers". Posting comments only doesn't hurt your ability to get points, especially if the content is casting some real new light on the matter in discussion :).

Thanks,
F.

Thank you this seems like the best possible answer to the question...I am just sad that the best solution oracle provides is so complicated. (It's a lot more complicated than MS Access in this respect.) In fact...I installed the obfuscation package...but am still struggling with how to use it.

Hi,

For all new problems , new threads....I'm just kidding :-)

Do tell us what new problems are there and we'll see how much we can help you.

Regards,
Sudhi.