It is required to store the password in the database - how?

Question

PHP

The task is slightly non-trivial, the project requires storing the user's password from a certain resource on its side (because the resource does not have an API, and we need to store the user's credentials in order to constantly pull information from it).
The question is, how best to do this, so that at least not completely in the open? Somehow encrypt in the database, and put the key separately?
Thank you.

Answer 1

All options above: do not provide reasonable protection against data theft. Having gained access to the server, I can easily access all the passwords that are stored in the "clear" form.
Correct option:
Raise your API on an external server, to which open username / password of users will be thrown off. Contacts with this server only through API, at the level: save data, start work, return work status, update data.
Then even if I get access to the main server, I will not physically be able to get the public passwords of users. The maximum that I can do is harm by deleting this data. But I can do this on the main server as well.

Answer 2

php.net/manual/ru/faq.passwords.php
Use what the language gives.
php.net/manual/en/function.password-hash.php

Answer 3

Solution: encrypt all data to access the third resource using the user's password to access your site, and do not store the password in the database.
During authorization, we decrypt the data and put it in temporary storage in memory.

Answer 4

you can encrypt passwords like this

CREATE OR REPLACE FUNCTION el_encrypt
(
  value text
)
RETURNS bytea
AS $BODY$
BEGIN
  RETURN pgp_pub_encrypt(value, dearmor(pg_read_file('pgpkeys/pgp-pg-el-public.key')));  
END;
$BODY$ LANGUAGE plpgsql
SECURITY DEFINER;

decipher

CREATE OR REPLACE FUNCTION el_decrypt
(
  value bytea
) RETURNS text AS 
$BODY$
BEGIN
 RETURN pgp_pub_decrypt(value, dearmor(pg_read_file('pgpkeys/pgp-pg-el-private.key')));
END;
$BODY$
LANGUAGE plpgsql
SECURITY DEFINER;

when a database dump is received, the data cannot be read without keys, the keys are stored in the file system. this is a fairly simple and relatively secure storage option. how to generate keys is in postgresql description

Answer 5

Do not keep in the database, but keep in the config, which is available only to combat servers.