Data encryption

[Arlen]

How can I encrypt data with Autoit and at the same time not store the key in the script.

For example I want to be able to encrypt data and then when user enters password it will decrypt it, but not storing the key in the script because I don't find it safe to do that.

[jdelaney]

I was working on this...uses lots of guids for salts, hashes, and encryption based on the user provided password plus a salt:

Long story short, you can store a 'Hash' to verify the password is correct...to create a hash is a one way door.  It's much safer to hash the string with a salt:

https://crackstation.net/hashing-security.htm

1. The user creates an account.
2. Their password is hashed and stored in the database. At no point is the plain-text (unencrypted) password ever written to the hard drive.
3. When the user attempts to login, the hash of the password they entered is checked against the hash of their real password (retrieved from the database).
4. If the hashes match, the user is granted access. If not, the user is told they entered invalid login credentials.
5. Steps 3 and 4 repeat every time someone tries to login to their account.

Edited January 24, 2018 by jdelaney

[Arlen]

On 1/23/2018 at 11:11 PM, jdelaney said:

I was working on this...uses lots of guids for salts, hashes, and encryption based on the user provided password plus a salt:

Long story short, you can store a 'Hash' to verify the password is correct...to create a hash is a one way door.  It's much safer to hash the string with a salt:

https://crackstation.net/hashing-security.htm

1. The user creates an account.
2. Their password is hashed and stored in the database. At no point is the plain-text (unencrypted) password ever written to the hard drive.
3. When the user attempts to login, the hash of the password they entered is checked against the hash of their real password (retrieved from the database).
4. If the hashes match, the user is granted access. If not, the user is told they entered invalid login credentials.
5. Steps 3 and 4 repeat every time someone tries to login to their account.

Thanks!!