I'm sorry, but this is posted as a learning resource so I wanted to comment on this as I haven't seen anyone else do so and I would hate to see people put this in production after using this app as an example.
But it is very bad practice to use AES or any symmetrical encryption to store passwords. Especially with only 1 private key being used for the entire database. If someone is able to brute force that private key, then your entire database's users have compromised passwords.
You absolutely should be hashing passwords instead and giving each a unique salt to protect against Rainbow Tables. SHA1 has now been found to have hash collisions, so that is no longer safe. It is in your best interest to hash passwords with SHA2 rather than AES.
Yes, AES relatively secure, however is someone is able to expose your private key from your server or brute force just 1 password using this shared private key, then your entire database is compromised. I urge you to at least comment on this in your code and in your article
I'm sorry, but this is posted as a learning resource so I wanted to comment on this as I haven't seen anyone else do so and I would hate to see people put this in production after using this app as an example.
But it is very bad practice to use AES or any symmetrical encryption to store passwords. Especially with only 1 private key being used for the entire database. If someone is able to brute force that private key, then your entire database's users have compromised passwords.
You absolutely should be hashing passwords instead and giving each a unique salt to protect against Rainbow Tables. SHA1 has now been found to have hash collisions, so that is no longer safe. It is in your best interest to hash passwords with SHA2 rather than AES.
Yes, AES relatively secure, however is someone is able to expose your private key from your server or brute force just 1 password using this shared private key, then your entire database is compromised. I urge you to at least comment on this in your code and in your article