Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Softwares and Software Security

An Indian software vendor ships an update after finding that its application stores customers' passwords as plain text in the database. Which practice best aligns with secure software design for storing passwords?

Passwords should be stored as salted hashes created with a slow hashing algorithm. Hashing is one-way and salting defeats precomputed lookup attacks. Reversible encryption with a co-located key, simple reversal or plain text with access limits all leave passwords exposed after a breach.

  1. AStore a salted hash produced with a slow hashing algorithmCorrect
  2. BStore passwords encrypted with one key kept in the same database
  3. CStore passwords after reversing the character order
  4. DStore passwords in plain text but restrict database access

Explanation

Passwords should be stored as salted hashes using a deliberately slow algorithm, so they cannot be reversed and precomputed attacks are hindered. Encryption with a key stored alongside the data is reversible and the key is exposed in a breach. Reversing characters is trivial, and access restriction does not protect against a breach.

Did you get it right without looking?

One question tells you little. A timed set on Softwares and Software Security shows your real accuracy, how long you take and where you lose marks.

Practise Softwares and Software SecurityFree diagnostic mock

More Softwares and Software Security questions