Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

3
  • it may be worth noting that as the number of items you secure goes up, the cost of maintaining the same level of security increases as well. An attacker who retrieves a whole set of salted and hashed fields may have an easier time defeating your last-layer security than if only field was secured. Commented Dec 26, 2014 at 0:06
  • 5
    One might also want to reference the PCI DSS for various parts of securing the data (requirement 3) and communication channels (requirement 4) that required by the payment card industry (I suspect e-commerce touches n that). Commented Dec 26, 2014 at 3:09
  • 1
    Good point re: never letting a database query logger store a plaintext password. Of course, the plaintext password should never (ever) be used in a SQL query. Commented Dec 28, 2014 at 10:03