I'm about to add some user account and password functionality to my software, so I'm reading about password hashing.
So my understanding is Hashing is a one way function, and it works like this:
- User Bob Types in password box: “MyPassword”
- Request Sent to server for Bob’s Salt, and hash from database: Hash: 8912ep98as89uasdp Salt: 89asdjklasdo11jdsa
- “MyPassword” + Salt is hashed using same function and compared to retrieved hash
- If they match access is granted.
- The hash is stored in application memory for future comparisons.
Is that accurate? So that above has granted the user the ability to click around the application, but say my application is retrieving data from a server. I want things to be secure, so for each request from the service I pass along the authentication details (stored hash from step 5), and the service checks it against the database hash before returning a set of data.
Isn't knowing the hash kind of just as bad as knowing the password? If you found out the hash, you could use the service for nefarious means because all the password is used for is generating the hash, and the hash is used for all further authentication.
Edit, for clarification, this isn't a web app. It's going to be a WPF application, probably using WCF service to talk to a server.