System stores password encrypted

This is not a problem for Oracle user ids, as the password is stored in hash format and cannot be retrieved by the DBA; it can only be changed. However, other types of password management, such as that done through the application using a database table, tend to be stored in clear text. This practice should be prevented and the passwords should be encrypted using Oracle’s Obfuscation Toolkit, which is a set of encryption APIs. In Chapter 5, a complete treatise on secure application user management has been provided.