Solved

How to store last 6 passords

Posted on 2014-02-10
3
278 Views
Last Modified: 2014-02-12
Hi

I have to write some code .NET, where the user must NOT use password that matches the last 6 password they have used. Can someone please tell me how I would so that i.e. down to SQL level as well as C# level

thanks so much
0
Comment
Question by:mousemat24
  • 2
3 Comments
 
LVL 3

Accepted Solution

by:
cristiantm earned 500 total points
ID: 39846997
You just need to store hashes (use salted hashes) of the last 6 passwords in your database. Then for a new password, compare the new password hash with the old hashes.

I would have a table with some "USER ID" and "SALTED HASH" columns. Then get the last X (=6) hashes for the user id to compare. In case of no match, remove the X+1 entry from botton up from the table (if it exists) and add the new salted hash to the table.

You could also have X columns of old hashes, how you organize that is really up to you, I would prefer my suggestion over X columns because then it is easy to have X configurable.
0
 
LVL 23

Expert Comment

by:Michael74
ID: 39851985
@Mousemat24 I will second Cristiantm's idea and add that if you need a class to encrypt your passwords please have a look at the solution I posted in http://www.experts-exchange.com/Microsoft/Development/MS-SQL-Server/Q_27840448.html
0
 
LVL 3

Expert Comment

by:cristiantm
ID: 39852766
Michael74, this method you propose is *not* good. It implies on the key being stored on the server, and if an attacker can get to the stored password it probably can get the key too, so is just like using a lock on your door but keeping the key under the carpet.

Thats why using hashed salted passwords is the best and standard way to store passwords, since you do not need to decrypt them anyway, just check if it is correct, and you can do that on the hashed form.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

ASP.Net to Oracle Connectivity Recently I had to develop an ASP.NET application connecting to an Oracle database.As I am doing it first time ,I had to solve several problems. This article will help to such developers  to develop an ASP.NET client…
Real-time is more about the business, not the technology. In day-to-day life, to make real-time decisions like buying or investing, business needs the latest information(e.g. Gold Rate/Stock Rate). Unlike traditional days, you need not wait for a fe…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now