Passwords If your science gateway needs to handle user passwords: Protect passwords from online attack Use HTTPS Block brute-force attacks (e.g., Fail2Ban) Protect passwords from offline attack Store password hashes Use a strong hashing algorithm, with per-password salt Use existing password hashing implementation e.g., PHP password_hash() http://security.blogoverflow.com/2013/09/about-secure- password-hashing/ sciencegatewaysecurity.org | trustedci.org
{}