Maybe by having the database on external hardware with an API, but I can imagine this is hard to scale. What if you need to sync it across several load balancing servers, or what if you want to make backups?
Maybe by having the database on external hardware with an API, but I can imagine this is hard to scale. What if you need to sync it across several load balancing servers, or what if you want to make backups?
One can design a special hardware, with a port for just comparing passwords and a port for copying. A Hacker would need physical access to copy the database.
>> Load balancing
Could be part of the design.Say card in a box, with internal physical connection inside the box for copying.
... then it's game over for you. But I guess intruders typically use either SQL-injection or somehow get the application password to access the password table. In both cases an unreadable table would thwart the intruder.
If the only way your production server can check passwords is by sending hash(salt+pw+salt) and getting a true\false reply from a piece of external hardware...then even if an intruder got complete control though some exploit or injection, he wouldn't be able to dump the database for later cracking with rainbow tables.
See also [2] for a cute implementation using an Arduino to secure an AWS API key
[1] https://en.wikipedia.org/wiki/Hardware_security_module
[2] http://stefan.arentz.ca/signing-aws-requests-with-your-ardui...