Click here to Skip to main content
15,886,963 members
Home / Discussions / Design and Architecture
   

Design and Architecture

 
GeneralRe: user data system for a web-based e-mail service Pin
Eddy Vluggen18-Jan-24 7:30
professionalEddy Vluggen18-Jan-24 7:30 
GeneralRe: user data system for a web-based e-mail service Pin
Gerry Schmitz18-Jan-24 11:35
mveGerry Schmitz18-Jan-24 11:35 
GeneralRe: user data system for a web-based e-mail service Pin
Eddy Vluggen18-Jan-24 16:53
professionalEddy Vluggen18-Jan-24 16:53 
GeneralRe: user data system for a web-based e-mail service Pin
Richard Andrew x6419-Jan-24 12:06
professionalRichard Andrew x6419-Jan-24 12:06 
GeneralRe: user data system for a web-based e-mail service Pin
Gerry Schmitz19-Jan-24 13:24
mveGerry Schmitz19-Jan-24 13:24 
GeneralRe: user data system for a web-based e-mail service Pin
trønderen19-Jan-24 14:31
trønderen19-Jan-24 14:31 
PraiseRe: user data system for a web-based e-mail service Pin
Eddy Vluggen10-Feb-24 10:12
professionalEddy Vluggen10-Feb-24 10:12 
AnswerRe: user data system for a web-based e-mail service Pin
Richard Deeming29-Jan-24 4:03
mveRichard Deeming29-Jan-24 4:03 
mike7411 wrote:
You want to store the following data about each user:
...
password
If that's the user's password for your application, then you most definitely don't want to store it! Instead, store a salted hash of the password, using multiple iterations of a cryptographically-secure one-way hashing algorithm:

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

If it's the user's password for a third-party system, then you've got a much bigger problem to deal with. The data will need to be encrypted at rest, with appropriate controls in place to ensure that nobody other than the user who owns the record can access their plaintext password. You'll need a robust strategy for storing and rotating your encryption keys. You'll need comprehensive auditing of access to those keys. And probably a million other things I haven't thought of.



"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

GeneralRe: user data system for a web-based e-mail service Pin
Eddy Vluggen10-Feb-24 10:14
professionalEddy Vluggen10-Feb-24 10:14 
QuestionSilly Logging Question Pin
Kevin Marois27-Dec-23 17:05
professionalKevin Marois27-Dec-23 17:05 
AnswerRe: Silly Logging Question Pin
Mircea Neacsu27-Dec-23 17:32
Mircea Neacsu27-Dec-23 17:32 
AnswerRe: Silly Logging Question Pin
jschell28-Dec-23 6:25
jschell28-Dec-23 6:25 
QuestionImplementing domain driven design Pin
Jan Hein de Jong23-Dec-23 10:41
Jan Hein de Jong23-Dec-23 10:41 
AnswerRe: Implementing domain driven design Pin
Gerry Schmitz24-Dec-23 6:34
mveGerry Schmitz24-Dec-23 6:34 
GeneralWhy I don't do MVVM. Pin
Gerry Schmitz22-Dec-23 9:46
mveGerry Schmitz22-Dec-23 9:46 
GeneralRe: Why I don't do MVVM. Pin
Greg Utas22-Dec-23 14:46
professionalGreg Utas22-Dec-23 14:46 
GeneralRe: Why I don't do MVVM. Pin
jschell25-Dec-23 7:53
jschell25-Dec-23 7:53 
GeneralRe: Why I don't do MVVM. Pin
Greg Utas25-Dec-23 8:28
professionalGreg Utas25-Dec-23 8:28 
GeneralRe: Why I don't do MVVM. Pin
Dave Kreskowiak22-Dec-23 15:24
mveDave Kreskowiak22-Dec-23 15:24 
GeneralRe: Why I don't do MVVM. Pin
Gerry Schmitz23-Dec-23 7:30
mveGerry Schmitz23-Dec-23 7:30 
GeneralRe: Why I don't do MVVM. Pin
jschell25-Dec-23 7:55
jschell25-Dec-23 7:55 
GeneralRe: Why I don't do MVVM. Pin
Gerry Schmitz25-Dec-23 11:35
mveGerry Schmitz25-Dec-23 11:35 
GeneralRe: Why I don't do MVVM. Pin
jschell26-Dec-23 4:37
jschell26-Dec-23 4:37 
GeneralRe: Why I don't do MVVM. Pin
Gerry Schmitz26-Dec-23 7:03
mveGerry Schmitz26-Dec-23 7:03 
GeneralRe: Why I don't do MVVM. Pin
jschell27-Dec-23 5:19
jschell27-Dec-23 5:19 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.