Upgrade password storage

[disconsented]

SHA256 is pretty easy to brute force, GPU attacks are especially effective. I recommend moving passwords over to Bcrypt or Argon2

[SeraphJACK]

Are you a bitcoin miner or something?

[SeraphJACK]

Alright that's a joke

I'm considering.

[SeraphJACK]

I know little about cryptography so maybe I'm wrong.

But since the encryption is open to public, the only way to be more secure is moving to some asymmetric encryption methods like RSA, instead of these symmetric ones.

[SeraphJACK]

And by default users are using random generated UUID as password, maybe the security is not that important.

Also, you can use your own method to encrypt it and copy it into configuration.

[disconsented]

Bcrypt/Argon2/SHA256 are examples of hashing not encryption, the point is that you can't reverse them.

[SeraphJACK]

We don't have salt in this case.

[disconsented]

Not a real issue with either, the salt is randomly generated per password and storage in the same r ecord

[SeraphJACK]

So you need to copy the file instead of remember the password.

Then why not just use generated one?

[disconsented]

Users just need to remember the password, any library worth its salt (ha) will have a comparison function to handle that for you.

[SeraphJACK]

@Yesterday17

[SeraphJACK]

Check #4

[SeraphJACK]

However, since the check must be done at the server-side, there's still a possibility that someone can get the SHA256sum.