Password with Hash

Toh Zuan Yi

Hii Again :) i have another question about passwords.

I have a webpage where users can change their information and passwords. On the Edit Click, i got the userID and navigated to the edit Page, Got all the info from the Database E.G UserType(Admin for example), Name, Gender, Password(Hashed like 16351%^&$%^5465%$&^hbv87b8T&%$). For my UpdateUser class, i input a paramater like this for password

db.AddInParameter(cmd, "@Password", DbType.String, HashHelper.CreateHash(user.Password));

and there for it updates the new password the user has typed and creates a hash code stored in database.
BUT, there was a minor bug in this. What if the User doesnt change password? For E.g just other information about himself but not the password. As you know i Got all the info about the user on Page_Load event after the edit button is clicked and navigated to edit page. The "info" includes the Hashed password, which is the very long thing i stated above. So if the user doesnt change passwords and presses update, i would store the Hashed password as the real password and hashed yet again to be stored in database(meaning the user has to type the hashed code which he doesnt know to log in).

What i need is to retain the original password after navigating to Edit Page (not the hashed code) so if the user doesnt change passwords the same password will be hashed and stored into database. Can anyone help me?

Basically i used

this.txtChangePassword.Attributes.Add("value", Password);

to input my hashed password from database to the textbox.

4 Replies

Know the answer? Post it — somebody with the same question will find it here.

Bryian Tan15y ago
hi,

This should works. Don't load the password into the edit form field. Use a dummy value in the password field in the edit form. if the password field value != dummy value that mean the user want to update the password. If that the case include the Password column in the update query, else just update the table without the Password column.
Toh Zuan Yi15y ago
but the problem is, i cannot send a null value into my UpdateUser as it my table does not allow nulls so how do i maintain the old password in the database if a null value for password is sent to update?
Benjamin Kemner15y ago
Why is it necessary to load the password or the hash into the edit form? I would leave password field blank and only if the user enters a password it should be hashed and saved. The basic security thought using hashed passwords is to let nobody now about the plantext password. But you try to reconstruct it.

Loading the plaintext password into the edit form is a additional security risk because someone logged in could leave his desktop and an 'attacker' can see the password by using "edit profile" and "site source code" in browser.
Zoran Horvat15y ago
If I understand you well, you have a control, e.g. textbox, which allows the user to enter new password. Now you put the hashed password into that field and then re-hash it again on submit.

Porblem is that you're sending hash to the interface at the first place. Hash should be used only to compare password against it.

To resolve the issue, you can send null to the interface. Only if password on submit contains non-null value then conclude that password has been changed.

Zoran