Is it okay to store the password in a public class variable?

I've done a related question on handling passwords embedded in the code. The answer I got is that it is recommended to use some kind of hash (with salt ) in these passwords.

The reasoning behind this is this: someone can gain access to your source code, in which case the password would not be exposed, just the hash. And the advice they gave me was to store the hash of the password in a separate file, so that the source code does not need be changed in multiple application installations.

The public and private object orientation has to do with the organization and modularization of your code, and no is a factor that matters in safety. A public variable will not be visible outside of your program and a private variable doing idiocy will still be a security problem.

As for hashing, do not use md5! Md5 is a hash that was made to be very fast to run and that's a bad thing when you're dealing with passwords. If a hacker gets access to a copy of his database with the password hashes, he will be able to "kick" the passwords of his users much faster than he could do via the normal web interface. The faster your hash function, the more passwords the hacker can kick in a minute, and the less time it will take for him to discover the real password.

To store passwords, it is best to use a slow hash, preferably one in which you can pass set up slowness with a parameter to make the hash as slow as possible without adversely affecting its performance. Some common examples of these special hashs for passwords are bcrypt, PBKDF2 and scrypt. I also strongly recommend using some ready-made library that implements these password protocols since it is very easy to implement something unsafe if you do it on hand. In the case of PHP (since version 5.5), you can use the password_hash and password_verify functions, which implements a password protocol using bcrypt.

link

In a login system, passwords must be persisted (in a database, for example) after they have been hashed (for lack of a better word) with a salt randomly generated for that user (as referred to by @bfavaretto). Thus, in BD, each user must have at least 3 stored items: username , hashed password and salt .

As soon as the user's password enters the server, you should follow these steps (in pseudocode):

login(username, password) {
    //obter informacao do user
    User user = bd.getUser(username);

    //obter o salt deste user
    string salt = user.salt;

    //"hashar" a password introduzida pelo utilizador
    //e verificar se corresponde a' password na BD
    if(Hash(password, salt) == user.hashed_password) {
        //login com sucesso
    }
}

Do not forget that when a new user registers, it is necessary to generate random salt :

registar_user(username, password) {

    string salt = random(); //gerar salt
    string hashed_password = Hash(password, salt); //"hashar" password com o salt gerado

    db.Insert(username, hashed_password, salt);
}

Note : Warning, do not confuse hashing with encryption. MD5 is a hashing algorithm, not encryption. In addition, has been proven in 1995 and 2004 that the MD5 algorithm has serious flaws and should not be used . Instead, use SHA256 or SHA512.

Encryption algorithms are used in other situations to prevent intercepted messages from being decrypted or changed, for example. There are symmetric (AES) or asymmetric (RSA) algorithms.

  

If I use encryption, will my system be very slow with many users logging in at the same time?

Hashing algorithms are very fast, especially when the input is small, as in the case of passwords. In addition, safety always comes before performance. Performance can be improved later by climbing vertically or horizontally.

How you process passwords in your code is irrelevant. What matters is how it stores for example in the database.

In your code you are not storing in the database, but only in a class variable. So it does not make sense to use any hash function or encryption as this will not add any security to your script.

What you have to worry about is hashes only when it is stored in the database.