Solved

How to store last 6 passords

Posted on 2014-02-10
3
280 Views
Last Modified: 2014-02-12
Hi

I have to write some code .NET, where the user must NOT use password that matches the last 6 password they have used. Can someone please tell me how I would so that i.e. down to SQL level as well as C# level

thanks so much
0
Comment
Question by:mousemat24
  • 2
3 Comments
 
LVL 3

Accepted Solution

by:
cristiantm earned 500 total points
ID: 39846997
You just need to store hashes (use salted hashes) of the last 6 passwords in your database. Then for a new password, compare the new password hash with the old hashes.

I would have a table with some "USER ID" and "SALTED HASH" columns. Then get the last X (=6) hashes for the user id to compare. In case of no match, remove the X+1 entry from botton up from the table (if it exists) and add the new salted hash to the table.

You could also have X columns of old hashes, how you organize that is really up to you, I would prefer my suggestion over X columns because then it is easy to have X configurable.
0
 
LVL 23

Expert Comment

by:Michael74
ID: 39851985
@Mousemat24 I will second Cristiantm's idea and add that if you need a class to encrypt your passwords please have a look at the solution I posted in http://www.experts-exchange.com/Microsoft/Development/MS-SQL-Server/Q_27840448.html
0
 
LVL 3

Expert Comment

by:cristiantm
ID: 39852766
Michael74, this method you propose is *not* good. It implies on the key being stored on the server, and if an attacker can get to the stored password it probably can get the key too, so is just like using a lock on your door but keeping the key under the carpet.

Thats why using hashed salted passwords is the best and standard way to store passwords, since you do not need to decrypt them anyway, just check if it is correct, and you can do that on the hashed form.
0

Featured Post

3 Use Cases for Connected Systems

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, testing some more, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is for Object-Oriented Programming (OOP) beginners. An Interface contains declarations of events, indexers, methods and/or properties. Any class which implements the Interface should provide the concrete implementation for each Inter…
Entity Framework is a powerful tool to help you interact with the DataBase but still doesn't help much when we have a Stored Procedure that returns more than one resultset. The solution takes some of out-of-the-box thinking; read on!
A short film showing how OnPage and Connectwise integration works.
Delivering innovative fully-managed cloud services for mission-critical applications requires expertise in multiple areas plus vision and commitment. Meet a few of the people behind the quality services of Concerto.

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now