• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 301
  • Last Modified:

How to store last 6 passords

Hi

I have to write some code .NET, where the user must NOT use password that matches the last 6 password they have used. Can someone please tell me how I would so that i.e. down to SQL level as well as C# level

thanks so much
0
mousemat24
Asked:
mousemat24
  • 2
1 Solution
 
cristiantmCommented:
You just need to store hashes (use salted hashes) of the last 6 passwords in your database. Then for a new password, compare the new password hash with the old hashes.

I would have a table with some "USER ID" and "SALTED HASH" columns. Then get the last X (=6) hashes for the user id to compare. In case of no match, remove the X+1 entry from botton up from the table (if it exists) and add the new salted hash to the table.

You could also have X columns of old hashes, how you organize that is really up to you, I would prefer my suggestion over X columns because then it is easy to have X configurable.
0
 
Michael FowlerSolutions ConsultantCommented:
@Mousemat24 I will second Cristiantm's idea and add that if you need a class to encrypt your passwords please have a look at the solution I posted in http://www.experts-exchange.com/Microsoft/Development/MS-SQL-Server/Q_27840448.html
0
 
cristiantmCommented:
Michael74, this method you propose is *not* good. It implies on the key being stored on the server, and if an attacker can get to the stored password it probably can get the key too, so is just like using a lock on your door but keeping the key under the carpet.

Thats why using hashed salted passwords is the best and standard way to store passwords, since you do not need to decrypt them anyway, just check if it is correct, and you can do that on the hashed form.
0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now