Log in with username/password: lyceum/lyceum

Ticket #894 (new enhancement)

Opened 9 months ago

Last modified 9 months ago

Passwords should be hashed uniquely by user

Reported by: lyceum Assigned to:
Priority: normal Milestone: 1.1
Keywords: Cc: dama@dnet.nu

Description

Current password hash schema using only MD5 is insecure as multiple users with same password will have the same hash and also, in case of an intrusion where the intruder gets access to the database, pure MD5 hashes is crackable by using rainbow tables and even if the users passwords are changed chances are the same password is used in numerous different places requiring many more changes.

By hashing with for example MD5($username + 'some string' + $password) every user will have hes/her's own unique hash and cracking it will be much much more difficult.

And more importantly they have to generate unique tables for each different user requiring much more time and processing power.

Change History

12/01/07 18:09:55 changed by jjb

  • milestone set to 1.1.

Agreed, hash should be salted. I believe that WordPress? > 2.3/4 does do this, so we will inherit that behavior when we sync.

Log in with username/password: lyceum/lyceum