2 Added a best-practices tag
| link
source | link

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many popular browsers to "Remember Password" for your typical user name password login fields.

I am having trouble coming up with an answer that I feel is acceptable. In light of Sony's embarassing security flaws, I really want to be careful, even though the data being stored on people is of a lower sensitivity. We are not storing social security numbers or even addresses however we are storing phone numbers, email addresses and a photo of a visitor.

He is concerned that a user can simply Remember Password on a public terminal, then someone can simply jump on this terminal and begin viewing or modifiy data in an unauthorized way. I am fairly certain however that at least on Windows workstations that the browser will not "Remember Password" across Windows user accounts.

Beyond this I am implementing a one way password encryption at the server side (store encryped password in the database, encrypt user supplied password on the server, compare to encrypted string from database). There are no immediate plans to incorporate SSL encryption however this is still an option.

Are there are any major security flaws with this approach? Do you have any better suggestions?