How to build safety login system?

[LabviewKK]

Hello,

I'm building a simple user login system. like following

01. Build a database(SQLite)

02. Insert the login information( Username and password)

03. Login Interface, the vi will search the match User.

But i think it is too risky, because anyone can access the database via kind of tools.

Can you share the experience to us about the safety login system?

[LabviewKK]

I'm building a simple user login system. like following

01. Build a database(SQLite)

02. Insert the login information( Username and password)

03. Login Interface, the vi will search the match User.

But i think it is too risky, because anyone can access the database via kind of tools.

Can you share the experience to us about the safety login system?

[BowenM]

One option is to rely on Windows (assuming that is your OS...).

Look at this API call:  https://msdn.microsoft.com/en-us/library/bb300969(v=vs.110).aspx

You can validate either a local or domain account.

[RTSLVU · Accepted solution]

You could encrypt the user/password database. 

Basic encryption is simple XOR a data stream and a repeating key, decrypt by XOR the encrypted data with the same key.

The longer the key the more secure the encryption.

Now you can store the user/passwords in a plain text file.

Read and decrypt the file into an array and do your user checking that way, no need for SQLight

[LabviewKK]

Hi RTSLVU,

You mean when i write the user information to database, i can XOR same key which is defined by me?

If it is, i have a root count( user: root and password: root), someone can decrypt the key?

[RTSLVU]

---

@LabviewKK wrote:

Hi RTSLVU,

You mean when i write the user information to database, i can XOR same key which is defined by me?

If it is, i have a root count( user: root and password: root), someone can decrypt the key?

---

Yes the encryption key is defined by you and would be "hard coded" into your executable so you don't have to enter it every time.  Also that means the key is not stored in clear text anywhere on the computer so even root can not just "find" the key

But sure someone who really knew what they were doing could probably look at the compiled code and find the key. But why would they?  

Having never worked with SQLight I can only guess but I think it would work if you encrypted everything as you wrote it and decrypted as you read it.

[jcarmody · Accepted solution]

I've saved the MD5 hash of a password + salt in a database.  That felt secure to me.

[LabviewKK]

Can you share the Vi for reference?

Because i can not drag the picture to Labview directly.  I don't know why.