salt and pepper

Ok, what is happening with the salt?

The more I’ve been tinkering around I just can’t undersand why this method wasn’t used:
SMF:{hasedpassword}:{salt}
OSC does bascially the same thing, except stores the salt with the password in the same field.

I wonder what other projects are doing .... like something like this would be a sweet WEB 2.0 standard.

Yes Carsten, we do need a much better password hashing approach, starting with the adoption of SHA over MD5. I’ve done some research into the latest thoughts on the subject recently, and will be using this research to implement a new authentication mechanism with a much more appropriate credentials storage design and more secure challenge-response mechanism. This will be done as part of the manager/web user convergence, which is in the works.

I’m considering using an approach involving both a public (transmitted to/from client) and random private (server only) salt value to make it as difficult as possible and practical, to crack user passwords using dictionary attacks or other techniques, making the strenght of the salt values configurable, so they can be adjusted based a balance of security and performance requirements for individual deployments.

More soon on this subject...

COOL!

Would just like to throw in, it would be nice to have the ability to connect to other applications. currently, I’ve been pulling my hair out just trying to figure out what to do about this problem when connecting to osc. I ended up hacking osc as that was the quickest way and the least amount of code to be written.

Would something like this be possible?