in reply to Encrypting a user name and password

As long as other people also have write-access to the file, there is no way you can keep the login information safe. Both, your password-checking Perl code and the file it reads are open to the users for manipulation, so there is no safety.

If the other people only have read-access, you can gain some limited "security" by using the crypt() subroutine and storing only the crypted passwords instead of the plaintext passwords. A user is then accepted if his crypted password equals the crypt you have stored in your file.

Another stupid idea would be to encrypt the whole file, stupid because a black hat would only need to look shortly at your Perl code to see what the decryption parameters are. If the stored file is not safe, neither is your Perl program.

  • Comment on Re: Encrypting a user name and password