How to protect data in a database?

Question

Node.js

Hello everyone, when writing a script, there is a task to make sure that if attackers get our script or database, they cannot get logins / passwords from there.
So it’s clear with the database, there are a bunch of libraries for encoding information in the database, and for decoding the key is used, which I usually kept in the config file. It turns out that if someone receives the script, they will also receive this key and be able to decode the data from the database. Question: how and where to store this key then, or what else can be used instead of these libraries, what other options are there? Thanks in advance.
ps usually used the bcrypt library

Answer 1

Store in the database not an encrypted password, but a hashed one using a one-way hash function. Then the attacker, having received all the data, will not be able to recover the password from the hash. This will only be possible by brute force, which can take a significant amount of time for each hash
> It turns out that if someone receives the script, they will also receive this key and be able to decode the data from the database
. A one-way algorithm does not have a key to decode. There is usually a salt to prevent iterating over the rainbow table. But salt does nothing to help an attacker get passwords. The bcrypt you specified is just a one-way hashing algorithm, and most likely you mean the salt by the key

Answer 2

Don't release the database to the internet and there won't be any problems.
Well, passwords everywhere should be complex.
And you can't store passwords in code - keep them in a secure vault that only trusted employees have access to.
Encrypting data in the database is an extreme measure, and not the most effective, and even harmful.

Answer 3

To do this, you need to slightly change the protocol for processing customer data.
To eventually come to end-to-end encryption on clients. This is quite difficult to explain on the fingers in a nutshell -
here it is roughly described how it works in practice -
https://staffcounter.net/en/introducing-p2p-encryp...
also read how it is done in mega.nz