Vote #69054
完了Add salt to user passwords
0%
説明
User passwords are stored as @SHA1(password)@ which makes them vulnerable to a dictionary attack from an attacker who gets access to the database.
The change consists of generating a salt for each user and storing @SHA1(salt+SHA1(password))@ in the database.
journals
Duplicates #6394.
--------------------------------------------------------------------------------
Feature committed in r4936.
--------------------------------------------------------------------------------
So now if attacker gets hold of the database all he has to do is to remove leading salt (since salt is stored in DB) and proceed with the dictionary attack. I don't see how this makes password any more secure...
--------------------------------------------------------------------------------
Rick I wrote:
> So now if attacker gets hold of the database all he has to do is to remove leading salt (since salt is stored in DB) and proceed with the dictionary attack. I don't see how this makes password any more secure...
Edit:
I take it all back. I didn't see salt+password_hash is hashed again.. my bad :F
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
related_issues
relates,Closed,6394,Add Salt to Authentication
relates,Closed,8514,Custom Password storing break pam_mysql
Admin Redmine さんが3年以上前に更新
- カテゴリ を Accounts / authentication_7 にセット
- 対象バージョン を 1.2.0_27 にセット