http://www.perlmonks.org?node_id=961293


in reply to Password Encryption and Decryption

Are you sure you want to use an encryption method that allows for decryption? That is not what most people consider to be a secure way of dealing with passwords. And it's hardly more secure than storing them in plain text.

Replies are listed 'Best First'.
Re^2: Password Encryption and Decryption
by slayedbylucifer (Scribe) on Mar 23, 2012 at 19:22 UTC

    I am not sure whether I really want what you have asked. But I have to pass the REAL password to my application because it will never recognize a crypted password. BTW, I am logging to my application with my Active Directory Account and hence I am providing the my AD password in clear text format in my script. So I wanted not to write it in clear text and rather have it in the encrypted form and then decrypt it on the fly every time the script runs. THis is the reason I need a decryption mechanism.

    Please do let me know if am thinking in wrong direction.

[reply]
      What makes this more secure than storing passwords in plain text? If a program can automatically decrypt the passwords, an attacker can as well - he'd just run the program. Of course, you could protect the "encrypted" password with a password, but than you're back to the beginning, aren't you?
[reply]

        Ok, so then is there a way I can have my script without a clear text password and still make it work?....

        My application will accept only AD password in their REAL form. Because sending an encrypted password to the application will get me access denied as that would be a wrong password.

        The application provides Perl API for automating task. So, I wanted to know is there a way to get this done in perl.

        Thanks.

[reply]

      If you need to authenticate your users against a LDAP (like Active Directory), you have not to store user's passwords at all. You need not to store them.

      You need to use LDAP authentication for your appliation, when the user insert the login/password pair, you forward these info to Active Directory and if it confirms you know that the user is authenticated in that system.

[reply]
A reply falls below the community's threshold of quality. You may see it by logging in.

In Section Seekers of Perl Wisdom