Click here to Skip to main content
15,890,043 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
I saved the password in the database in encrypted form and this is done but when I am logging from that password(without encryption) it's not logging but when I use the encrypted password then it's logging but I want to login from decrypted password.

What I have tried:

Python
#here is what i done for saving encrypt password in database.
from cryptography.fernet import Fernet
import tkinter as tk
from tkinter import messagebox
import pyodbc

Password=ttk.Entry(frame,textvariable=string,text="",show='*')

def std_register(path):
    conn = pyodbc.connect('Driver={SQL Server};''Server=SHUMAILA\SHUM;''Database=FYP;''Trusted_Connection=yes;')
    cursor=conn.cursor()

std_password=Password.get()
encrypt_password=std_password.encode()
key = Fernet.generate_key()
f = Fernet(key)
encrypted_password = f.encrypt(encrypt_password)
cursor.execute('insert into student_registeration_record(std_password)values(?)',encrypted_password
messagebox.showinfo('Registered','Successfully registered')
cursor.commit()

signup=tk.Button(root,text="Browse here",command=std_register)
signup.place()

Python
#here is what i done for logging

from cryptography.fernet import Fernet
import tkinter as tk
from tkinter import messagebox
import pyodbc


Password_txt=ttk.Entry(frame,textvariable=string,text="",show='*')

def login(event=None):
    password=Password_txt.get()
    cursor.execute('select std_password from student_registeration_record where std_password)=?',password
if cursor.fetchone() is not None:
    messagebox.showinfo("Message","Successfully login")
else:
    messagebox.showinfo("Message","Invalid username or password")
cursor.close()
conn.close()
signin=tk.Button(root,text="Browse here",command=login)
signin.place()


both methods are done on different files
Posted
Updated 21-Sep-19 9:00am
v2

1 solution

Don't encrypt passwords - it's very insecure, about on a par with storing it in plain text.
This explains why and how to store them: Password Storage: How to do it.[^] - the code is in C#, but it's pretty obvious.
 
Share this answer
 
Comments
Visweswaran N 21-Sep-19 22:06pm    
Hash it with SHA512 and hash it again with bcrypt with random salt. So that it is hard for brute-forcing and makes the rainbow table useless.
OriginalGriff 22-Sep-19 2:24am    
You don't need to - just hash it with the salt. No need for further encryption, that's the whole idea ... and you don't use a random salt because you need to be able to do exactly the same thing again in order to check the user input against the db when he tries to log in with it. Random salts would make the resulting hash different from the stored value...
Mostly, you use the userID (not the username) as the salt to prevent the same password appearing as the same hash value

And how the heck do you expect any form of encryption to prevent brute forcing? That's the process of trying every possible input until you get a match, and is prevented by limiting attempts within a set time period...

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900