Safeguarding sensitive information

Baz has asked for the wisdom of the Perl Monks concerning the following question:

Replies are listed 'Best First'.
Re: Safeguarding sensitive information by tjh (Curate) on May 15, 2002 at 23:08 UTC
Wow, are you gonna get some answers... Have a look at some of these threads. There are plenty of ideas, suggestions and lessons. •web site design, or lack thereof -- essential Perl/CGI Security Question Securing Passwords Essential CGI Security Practices CGI Security CGI Password/Login and Security CGI Password There are more. I'm sure I've missed two or three excellent threads, but if you SuperSearch you should find plenty to be enlightened by. It isn't just the client you should worry about...	[reply]
Re: Safeguarding sensitive information by yodabjorn (Monk) on May 15, 2002 at 23:21 UTC
Agreed, more info needed about what this is for. Is it a web system ?. is it some UI ? is it somthing that will give destructive power?. Risk asseement is needed then you can devise a method for the ammount of security you need. In general passwords are weak protection, but also one of the most basic forms of protection. there are many articles on the web about risk assesment and password sucurity/policies.that i am not gonna go into in the scope of this post. see SecurityFocus Besides that. I would look into cpan Crypt, and the perl crypt implentations. Most password systems story only the crypted version of the password and compare the user input crypted and matched against the stored crypted string. This way the file has no plain password, unfortuanatly the standard DES encryption is verry week and can be brute forced quite fast. If this is a web system on apache there are many ways to authenticate users. Apache Docs other than that make the file 0400 only by the user that runs the script. and make sure that its not acessable via the web or some other remote connections.	[reply]
Re: Safeguarding sensitive information by Marza (Vicar) on May 15, 2002 at 22:49 UTC
A little more information please. What exactly are you trying to do? As an ex-security guy, my eyes started twitching at the mention of storing passwords. ;-), At the base level, this does have risk. You can chmod the file so that only your id has access but then you still risk somebody getting your id. There are many arguments for not doing this.	[reply]
Re: Re: Safeguarding sensitive information by Baz (Friar) on May 15, 2002 at 23:04 UTC
Well, one of the passwords is my MySQL password. My perl scripts need this passwords in order to access the database. I've heard that its not safe to put the password in the script - such as `$password = "kjkjkjkjkj";` [download]	[reply] [d/l]