Hi,
I was investigating the use of dbms_obfuscation_toolkit from oracle in order to encrypt and decrypt user passwords. Everything is working fine. But here is my question:
The encrypt and decrypt procedures use a key to encrypt the given word. So, if anyone has access to the key, they can easily decrypt the passwords in the appuser table.
In our application, we have a stored procedure that does the password updates. so, any dba can just look into dba_source view and get the contents of the stored procedure, thus, get the key (as the key is hardcoded in the stored procedure) and then write his / her own stored procedure to decrypt all users passwords.
How did you get around this problem ? Is there a better way to do this ?
Thanks in advance for all your help.
Neelima
