digitalfabrik / entitlementcard

App for 'Digitale Berechtigungskarten', generally benefit card for volunteers or socially vulnerable groups in Germany. App for Android & iOS + Backend + Administration Web Portal – 100% Open Source.
MIT License
35 stars 3 forks source link

Create user data hash #1433

Open f1sh1918 opened 2 months ago

f1sh1918 commented 2 months ago

Is your feature request related to a problem? Please describe. Since the user data is sensitive it should be hashed

Describe the solution you'd like

Describe alternatives you've considered use the existing hashing algorithm

Additional context It has discussed if we switch to the same hashing algorithm for everything (but this also may need additional resources which are not needed) https://argon2.online/

michael-markl commented 2 months ago

It has discussed if we switch to the same hashing algorithm for everything (but this also may need additional resources which are not needed)

There is no real need to use a "slow" hash algorithm for the card info hash (as we add random bytes to it - the pepper). Also we'd have to do it backward compatibly somehow.

f1sh1918 commented 2 months ago

It has discussed if we switch to the same hashing algorithm for everything (but this also may need additional resources which are not needed)

There is no real need to use a "slow" hash algorithm for the card info hash (as we add random bytes to it - the pepper). Also we'd have to do it backward compatibly somehow.

Yes I was also thinking about that issues. "It has be discussed" Was what I wanted to write... And yes password hashing would be difficult and we would have to support two ways of hashing maybe old passwords would never be changed if we don't force it