Change password hashing from SHA1 to bcrypt

eclipse-archived / ceylon-herd

The Ceylon repository web application

Apache License 2.0

21 stars 11 forks source link

Change password hashing from SHA1 to bcrypt #98

Closed FroMage closed 10 years ago

FroMage commented 11 years ago

Apparently SHA1 is laughable in case the DB gets hacked. We should use bcrypt I heard. Since bcrypt handles its own salt we can get rid of our salt column. There's a Java lib for that.

FroMage commented 11 years ago

http://crackstation.net/hashing-security.htm has some useful info

FroMage commented 10 years ago

Fixed!

tombentley commented 10 years ago

I hope you didn't go adding any backdoors while you were at it

FroMage commented 10 years ago

Who needs backdoors when the front door is wide open?