medium
Single Answer
0Kimon is the identity architect for a growing e-commerce website that wants to leverage social identity. To do this, he and his team intend to allow users to use their existing Google accounts as their primary accounts when using the e-commerce site. This means that when a new user initially connects to the e-commerce platform, they are given the choice between using their Google account using OAuth 2.0 or creating a new account on the platform using their own email address and a password of their choice. When the e-commerce application creates an account for a Google user, where should that user's password be stored?
Answer Options
A
The password is stored in the e-commerce application's database.
B
The password is stored in memory on the e-commerce application's server.
C
The password is stored in Google's account management system.
D
The password is never stored; instead, a salted hash is stored in Google's account management system.
Correct Answer: D
Explanation
Passwords are never stored for web applications in a well-designed environment. Instead, salted hashes are stored and compared to passwords after they are salted and hashed. If the hashes match, the user is authenticated.