search

chaitu236 / TakServer

Server to handle online TAK games
https://www.playtak.com
GNU General Public License v2.0
35 stars 8 forks source link

Passwords are stored in plaintext #4

Closed atoponce closed 8 years ago

atoponce commented 8 years ago

Passwords should be hashed before storing to disk. If the account database is leaked online, account credentials would be in the clear. Using a strong password hashing function (not general cryptographic hashing functions like MD5, SHA-1, SHA-256,512, etc.) like bcrypt will ensure that the password cracker needs to spend significant amounts of CPU brute forcing the hashes to discover the passwords.

Alternatively, you could use the scrypt PBKDF as a password hashing function, which also requires memory hardness in addition to CPU hardness like bcrypt.

Libraries exist in Java for both bcrypt and scrypt:

http://www.mindrot.org/projects/jBCrypt/ https://github.com/FauxFaux/scrypt

eapache commented 8 years ago

Stored passwords should also be salted to prevent precomputation attacks.

atoponce commented 8 years ago

If using bcrypt or scrypt, this is handled transparently as part of the algorithm.

eapache commented 8 years ago

That's nice of them, didn't realize that.

atoponce commented 8 years ago

If the implementation does support automatically creating the salt, then of course create one. I guess it all depends on the implementation.

chaitu236 commented 8 years ago

Password encryption implemented by 5c86865a4de343c0a56dcecbc2fe8a3052f0b246