Open muppeth opened 3 years ago
While testing the plugin I noticed both secrets and backup codes are saved in plaintext in the database. Shouldn't those be hashed? Currently sysadmin or anyone with access to the database can easily brutteforce access to the webmail.
I think we need the 2FA OTP Secret, but can probably hash the backup codes!
While testing the plugin I noticed both secrets and backup codes are saved in plaintext in the database. Shouldn't those be hashed? Currently sysadmin or anyone with access to the database can easily brutteforce access to the webmail.