Re: Saving and Encoding Passwords

[Florian Weimer <fw@s.netic.de>]

joshhighley@hotmail.com (Josh Highley) writes:

>   I'm writing an Ada program that checks email accounts.  I'm
> storing the user name, password, and other info in a text file that
> my program references on startup.

Do you need the passwords themselves, or do you want to check whether
the password entered by the user is correct?  In the latter case, you
should not store the password itself, but a cryptographic hash of it.
It is considered close to impossible to recover the password from
the hash value if the cryptographic hash function is one of the most
commonly used and thoroughly analyzed (i.e. MD5 or SHA-1).

If your program needs the passwords themselves (for example, to
authenticate itself with a POP mail server) and you don't want any user
interaction, you can't get much security, because your software must
be able to decrypt the passwords -- and so is a possible attacker.