Saving your data into the database can be done in plain text. Ofcourse, I take security very high, and do not assume my database will be hacked. But I am also realistic: everything can be hacked, also my database.
My granddad had several shoe shops. Every night before closing, he emptied the cash registers, to put the money on his company’s bank account. He always left the cash registers open. “If a burglar comes into a shop, and does not know I always empty the cash register, he might try to force the cash register to open. That’ll give me more damage to deal with”, he said.
I cannot empty the database before a hacker tries to attack. KairosPlanner.com is online 24 hours a day, and hackers do not call it a day at 17h00. So my approach is just the other way around: if, or when, a hacker gains access to the database behind KairosPlanner.com, I want the data to be as much as unusable for the hacker as even possible. So I don’t save the data in plain text, but I encrypt it.
Passwords are not encrypted, they are hashed. This means, that there is no way to recover the passwords. How does the system checks if you are using the right passwords? Well, if your password is 12345, and the encryption method is just to add all the numbers, then encrypted your password will be 15 (1+2+3+4+5). So if you try to login with password 12346, the system will return: “wrong password”. OK, this example is very simple, the real method is much more complex 🙂
But there are other things in the database, that needs to be encrypted in a decryptable way. E.g. your e-mail address. Because the system needs to be able to send you an e-mail, while your address has to be gibberish for those, who do not know how I encrypted the address.
And that is where I got aware of a problem (this might be a bit technical): in many years, I used a method called RIJNDAEL to encrypt. RIJNDAEL uses a function called mcrypt. But in the newest version of the program language, PHP, the mcrypt function has been deprecated. So I needed to find another method of decryptable encryption.
Fortunately, I found one. Now I need to decrypt all the data in the database with the old method, and encrypt it with the new method. Well, it keeps me off the street 🙂
Have a wonderful and effective week,
Albert