Should we switch to another, better, more secure hash algorithm for passwords?
Glad to hear the problem was rised before.
Actually, a logic and comfortable "upgrade path" was exactly what I wanted to talk about after finding out if there is consensus about this topic.
Maybe something like
"Test with MD5. Confirmed? Ok, let’s PBKDF2 (or SHA256, or Whirpool, or anything) it and set a flag so next time it’s checked against the new hash."
?
-
☆ A M B ☆
- 24,524 Posts
Maybe it could start out as an option that can be set in the configuration, with the default left as the existing md5 hash. That way people can begin to move their sites onto this method when it’s feasible to do so, or a new site.
-
☆ A M B ☆
- 24,524 Posts
I would certainly begin using this on all new sites it there were a clear patch for Evo; I always use WebLoginPE for front-end logins, and that should be easy enough to patch.
-
☆ A M B ☆
- 3,141 Posts
Actually it was filed, but the link Shaun posted was broken due to the switch to Redmine:
http://bugs.modx.com/issues/325
Ok now i see, I was thinking Evolution. That’s what I filed it for.
-
☆ A M B ☆
- 3,141 Posts
Oh!
I didn’t even notice that, lol.
I guess it should be improved in both versions then.
