How to encrypt fields in models (like password field in user model)?
First, to be precise, the passwords in the User model are not “encrypted”, they’re “hashed”. (The key difference here is that encryption is reversible, hashing is not. There’s no way to take the hashed password and recover the plaintext password from it.)
To try and answer your question, it would be helpful to fully understand the “why”. What exactly are you trying to achieve? (The more details you provide about what you’re really trying to accomplish, the better chance we have of giving you an answer that will be useful and correct.)
1 Like
Hi bro,
Actually, what I am getting value from my users and using that value I am going to perform a certain operation and the value should be only viewed or edited by the user and not by me or any other admins. So that I thought that Encrypting that value will good at this senario. If you have any other Ideas suggest them to me or else tell me how to encrypt them.
And for my knowledge If the passwords are hashed then while we try to log in, it again attempts to hash the password that I give in login form and check whether the hash comes from the login attempt and the hash in the database are the same. Am I right? If wrong corrects me.
Thank you
Regarding the password hash, you are completely correct.
This is a remarkably difficult problem, one that I’ve never seen completely addressed.
First, the bottom line: Acknowledge that the admins are going to have access to that data, and greatly restrict those granted admin access. Anything else opens you up to the potential for even larger problems.
Traditionally, Information Security training focuses on 3 (4) pillars: Confidentiality, Integrity, Availability, and in many cases, Privacy. And, it’s generally acknowledged that there are always trade-offs. Increasing any one of those frequently results in a reduction of one of the others. It’s a balancing act.
Yes, you can make the user enter an encryption/decryption key every time they wish to read or edit a value. But what happens if they lose / forget that key? You now have inaccessible data that cannot be recovered.
There’s a good parallel for this with the encryption of files in Windows. If an admin changes the password, access to all encrypted files is effectively lost.
In every corporate environment in which I’ve worked, Integrity has always been the most important. Nothing was ever done that could damage or lose data. That meant that all encrypted corporate data was secured through means allowing recovery with at least two separate keys, with one key kept under the most-secure-available method.
Even with that, backups were almost always made unencrypted. If you had to recover from a backup (disaster recovery situation or historical research), you may not be able to rely upon having the same security infrastructure from which the original backup was made.
1 Like
That was awesome bro, It teach me a lot, First of thank you for your time.
Bro and I forget to tell a thing the value which I am talking about is, can be obtained by the user at any time and even that data get lost there is no problem because the user can get it anytime from its mainstream. The reason why I want to encrypt the data is TRUST. From my point of view, no one gonna believe this developing project, so as a bridge to trust, I think that the encryption idea will be helping me a lot.
And, I think “Asymmetric-key Encryption” should be good in this scenario. In which I am gonna generate the Private and Public Key randomly, then I will send the public key to the user mail which they will use that whenever they want to run that service. Any suggestions are welcome.
I can’t able to understand the above lines.
To be frank, I am an individual. And, almost using only the free services ( Heroku, Heroku Redis, Heroku Postgres Database, Github ). So, I am trying to key my data as secure as possible. I guess you will understand.
Thank you.
That doesn’t generate any more trust than you sending them their password. How do they know you’re not going to keep it?
(Not counting all the other difficulties associated with key management in a distributed environment.)
“Secure” doesn’t just mean “Access”. Security is all four attributes of data that I outlined above. You’re focusing on one aspect and ignoring the other three.
As far as I’m concerned, you’re wasting your time worrying about this. There is nothing you can do that can convince someone that you don’t have some kind of back door into the data.
1 Like
That makes sense. Anyway, Thank you for your time.