Better yet, don't store passwords at all. Use something like Digest::MD5 to store a digest of the password and when the user enters a username and password, create a new digest of their password and compare that against what is in the database. It's not fullproof (nothing ever is), but at the very least, it's considerably more difficult for someone getting a copy of the password digests to determine what those passwords actually are.

Also, you mentioned "security by obscurity". This has a tendency to induce a knee-jerk "if it's reasonably secure, you don't have to obscure it" reaction. However, if it's secure, obscurity can add to security by increasing the difficult of getting information useful for an attack. For example, if your code is secure, having use CGI::Carp 'fatalsToBrowser' in your code will theoretically not reduce the security. In reality, unanticipated bugs might trigger that and give information that might encourage the cracker. In other words, so long as true security is a top priority, obscurity is not such a bad thing.

Also, though it's peripheral to your question, you might find the LiveJournal login rather interesting. They use JavaScript to create a digest out of the password, remove the plaintext password from the form and then they submit. They don't transmit the plaintext at all. This increases security over a non-encrypted request.

Update: Oh, you meant database passwords. Sigh.

Cheers,
Ovid

New address of my CGI Course.

In reply to Re: Securing your scripts on webhoster's server by Ovid
in thread Securing your scripts on webhoster's server by b10m

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.