When developing an application, what’s the best practice for handling sensitive user input like passwords?

A.  Encrypt before storage

B.  Store in plaintext, but securely

C.  Hash and salt before storage

D.  Mask with base64

Correct Answer:  C

Explanation:

Handling sensitive user data securely is crucial, especially when it comes to passwords. Here's a breakdown of each option:

Encrypt before storage: While encryption is a secure method for storing sensitive data, it is not the best practice for passwords. Encryption is reversible, meaning if someone gains access to the encryption key, they can decrypt the passwords.

Store in plaintext, but securely: Storing passwords in plaintext, even in a 'secure' manner, is a severe security risk and should never be done.

Hash and salt before storage: This is the best practice for storing passwords. Hashing converts the password into a fixed-length string of characters, which appears random. Adding a "salt" (random data) before hashing adds another layer of security by making it more difficult for attackers to use precomputed tables (rainbow tables) to crack the passwords.

Mask with base64: Base64 is not a secure method of storing passwords. It's merely an encoding scheme and can be easily reversed.