Hiding a confidential field

Question

Hello friends at www.oracle.com ,
is there a way for me to hide a field from other users when these users do a SELECT statement?
For example, let's suppose I have an USERS table with NAME and PASSWORD field, and one user type a SELECT * FROM USERS, obtaining the result below:
USER | PASSWORD
-----+---------
ABCD | LIFE2002
EFGH | OTHERPSW
Is there a way for me to hide PASSWORD field? For example, showing asterisks (*) instead the letters? I know this can be done by creating a VIEW, but I need to know if there are other ways to hide this field.
Best regards,
Franklin Gongalves Jr.

Answer 1

You might be able to do something with Fine Grained Access Control or Trusted Oracle, but it is likely to be a bit of overkill to hide one field.
A view is probably your best option. Unless you are able to make changes to the table structure and the way the application accesses the database. I would not store something like a password in clear text. The best way to store a password is to use a hash, which is a non-reversible encryption algorithm.
To implement this
Define your password field as a number.
To insert a new record into the table, you would use something like:
INSERT INTO USERS (id,password)
VALUES (123,DBMS_UTILITY.Get_Hash_Value('mypassword',10000,1000000));This will store 123, 367925 in the database. There is no way to turn 367925 back into mypassword.
To validate your user you would do something like:
SELECT 1
FROM users
WHERE id = 123 and
password = DBMS_UTILITY.Get_Hash_Value('mypassword',10000,1000000);If this returns no records, then either the id or password is incorrect so don't let the user in.
So, if someone sees the table users, they may try 367925 as a password. This will hash to 177428 which is obviously not the same.