Part 5: Conclusion
Now after going through all that, how useful is this technique?
The crypto hash is only useful for passwords, however for that purpose it is indespensible. If you are
planning on setting up credit card transactions over the web, you will still need to set up a secure
socket layer connection between the browser and the client. Even if you do use SSL to protect data
travelling between the server and the client, SSL does nothing about protecting passwords that may
be cached to the local client. For this, you will still want to use the crypto hash.
Aside: The crypto hash has actually been in use for many years. Most operating systems use this
technique, or a variation thereof, to perform user authentication. It is quite rare that a system works
directly with a plaintext password, and in fact all UNIX-based operating systems I am aware of store
passwords in a relatively easy to access text file, however only the hashed version is ever stored. Once
a user sets a password, only the encoded version is ever kept.
|