I assume that when a user registers at a site, the password and username are stored inside of a database.I've read that the password is often encrypted using a salt. So, is it safe to encrypt the passwords with a salt and to save it in the same schema with the username?Secondly, how does authentication work? Companies like Google have giant databases of username/password pairs. How does validation work so quickly, and how is it implemented?
How do login systems work?
login
This question has some faulty assumptions, I'll try and clear these up first:Salts are not used as input to encryption but as input to one-way functions such as hashes. Some sites may store databases of passwords, which is how they can be hacked and their users passwords stolen, but you should NOT do this. General practice is to store hashes of passwords (and salts, see above) and when a user tried to log in, hash their provided password and compare the hashes. [Google does everything quickly. I don't know if they do map / reduce for authentication but they have a lot of smart people working on it, maybe this should be a separate question.]So salted hashes are then stored somewhere on the server. In terms of security I don't think it makes any difference whether you store them in a file, a relational database or in a NOSQL database. For speed at 'web scale' then you probably want to have a look at NOSQL databases and caching the data rather than using IO to disk.