How should I ethically approach user password storage for later plaintext retrieval?

Answer 1

I have the same issue. And at the same way I always think that someone hack my system it's not a matter of "if" but of "when".

So, when I must to do a website that need to store a recoverable confidential information, like a credit card or a password, what I do it's:

• encrypt with: openssl_encrypt(string $data , string $method , string $password)
  • PHP manual.
• data arg:
  • the sensitive information (e.g. the user password)
  • serialize if necessary, e.g. if the information is a array of data like multiple sensitive information
• password arg: use a information that only the user know like:
  • the user license plate
  • social security number
  • user phone number
  • the user mother name
  • a random string sended by email and/or by sms at register time
• method arg:
  • choose one cipher method, like "aes-256-cbc"
• NEVER store the information used in the "password" argument at database (or whatever place in the system)

When necessary to retrive this data just use the "openssl_decrypt()" function and ask the user for the answer. E.g.: "To receive your password answer the question: What's your cellphone number?"

PS 1: never use as a password a data stored in database. If you need to store the user cellphone number, then never use this information to encode the data. Always use a information that only the user know or that it's hard to someone non-relative know.

PS 2: for credit card information, like "one click buying", what I do is use the login password. This password is hashed in database (sha1, md5, etc), but at login time I store the plain-text password in session or in a non-persistent (i.e. at memory) secure cookie. This plain password never stay in database, indeed it's always stay in memory, destroyed at end of section. When the user click at "one click buying" button the system use this password. If the user was logged in with a service like facebook, twitter, etc, then I prompt the password again at buying time (ok, it's not a fully "on click") or then use some data of the service that user used to login (like the facebook id).