Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

Identity 3 copy hashed password from one user to another in DB

$
0
0

Is there a way to ensure that a password generated (hashed) for a user can only be used / associated by that user?

In other words I want to prevent:

  1. Hashed password is stored in the DB for user "a".
  2. Someone with DB access overwrites the hash for "b" with that of user "a".
  3. User "b" must now log in with the same password as "a".

I understand that users CAN have the same passwords if they happen to create it with the same value. I want to try and prevent the above scenario. Was thinking about the possibility of using the username as part of the password hashing / verification process.


Viewing all articles
Browse latest Browse all 4737