How to store a password hash on Windows Phone

Comments

Hamishwillee - A good tip

Thanks Influencer, a useful tip. I've subedited to make it a bit more readable - please confirm you're still happy with what it says!

hamishwillee 11:07, 25 September 2012 (EEST)

Joaocardoso - Good article

Security is one of the areas that a lot of developers leaves for last.

Can I suggest that you add the variant with a SALT? Using a SALT is much more secure because it prevents the use of HASH dictionaries to brute force attacks.

joaocardoso 02:36, 9 November 2012 (EET)

Hamishwillee - Joaocardoso - if you don't get a response ....

... try sending a private message (just hover over the username in the Articlemetadata). Influencer is usually pretty responsive, but its easy to miss the update email.

hamishwillee 07:03, 13 November 2012 (EET)

Influencer - Pretty busy...

Hi friends, I was pretty busy during the last few days gluing wallpapers and painting walls. Salt is a useful idea but where do you want to store it? You won't want to ask the user each time.

Thomas

influencer 07:16, 13 November 2012 (EET)

Log in or Join to leave comments.

This tip shows how to store a password hash value and use it for authentication of entered passwords. This is more secure than storing the password itself.

Applications that use login authentication should not store the application password directly, because the app's data may not be secure on the phone or backed up to a server/desktop. We've seen many successful attempts to acquire password lists by SQL injection break-ins, for example.

A better approach is to calculate a hash value for the password using a one-way function, and store this instead. This is compared to the hash values of user entered passwords afterwards in order to grant access to the application. Because it is calculated using a one-way function (that is very simple to calculate but very expensive to revert), even if a hacker can get the hash value they cannot use it to determine the password and access the app.

The ComputeHash function in the System.Security.Cryptography.SHA256Managed class uses a SHA 256-bit algorithm to compute the hash value. The GetHashCode() function below creates a hash of a string using SHA256Managed. It can be used to calculate both the hash value of the entered password to store, and the hash of password values entered by the user for comparison.

public static string GetHashCode(string p)
{
     var a = new SHA256Managed();
     return Convert.ToBase64String(a.ComputeHash(new System.Text.UTF8Encoding().GetBytes(p)));
}

See Also

How to encrypt your application data in Windows Phone

Article Metadata

---

Article

Created: influencer (24 Sep 2012)

Last edited: hamishwillee (10 Apr 2013)