开发者

How to hide value in database PostgreSQL

Anybody can help me regarding the database postgres? I need to hide the value in table that was cre开发者_Python百科ated.I need to hide the data password as like below example:

username password ana 123

I want the password appear like * Can anyone help me? Thank you in advance.


Take a look at pgcrypto module for some more options (like Extended DES crypt and PGP encryption). I don't recommend using MD5, because (IMHO) it's easily breakable nowadays (especially without any salt). Better choice is SHA-512 (or some of SHA-3 candidates: BLAKE, Grøstl etc.).

I think that it's good idea to check your hiding method against some (possibly GPU-accelerated) tools like hashcat. It really depends how valuable data you want to store.


The usual, and best, way is to store the MD5 of the password and compare that with the MD5 of the password entered. It fairly safe (but brute force can crack it given enough time).


One standard method of doing that sort of hiding is by creating a view, with all columns except the password column (or all columns, then '*' AS password). For the db user the application uses to connect, grant read access to the view, but remove read access for the source table. That way there is no chance of the application gaining access to the field.

Something like:

CREATE VIEW visible_users AS
  SELECT username, '***' as password
  FROM users;

Then make sure the privileges are managed appropriately:

REVOKE ALL ON users FOR app_user;

That said, you probably shouldn't be storing passwords in a database in plaintext -- it's a major potential security issue.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜