{"issue":{"state":"closed","created_at":"2011-11-28T16:16:24Z","updated_at":"2011-11-28T16:16:56Z","user":{"gravatar_id":"1c0dba2e2d4914062d95c1f45099537b","id":357895,"url":"https://api.github.com/users/fbender","avatar_url":"https://secure.gravatar.com/avatar/1c0dba2e2d4914062d95c1f45099537b?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"fbender"},"comments":23,"body":"To increase safety, all passwords in the Database should be salted using the encryption key generated during the installation.\n\nPseudo:\n\n```\n$userPassword = sha1($encryptionKey . $inputPassword);\n```\n\nDatabase dumps won't be useful anymore without the encryption key which prevents identity stealing (or something similar ;) ).\n\nThis might only increase the safety when a server has been hacked or an admin \"loses\" a databse dump but I'd say the small changes are truly worth it.\n\nFor further information: http://en.wikipedia.org/wiki/Salt_(cryptography)\n\n\nI thought this has already been implemented but I just found out it isn't ...\n\n[Download the attachments](http://www.contao.org/tl_files/tickets/142.zip \"Download the attachments of this ticket\")\n\n--- _Originally created on September 27th, 2008, at 11:31pm (ID 142)_","assignee":{"gravatar_id":"87d2e5aefadcb310f9155df28c2b3582","id":1192057,"url":"https://api.github.com/users/leofeyer","avatar_url":"https://secure.gravatar.com/avatar/87d2e5aefadcb310f9155df28c2b3582?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"leofeyer"},"id":2369105,"number":142,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"labels":[{"name":"Feature","color":"4183c4","url":"https://api.github.com/repos/contao/test/labels/Feature"},{"name":"framework","color":"e6e6e6","url":"https://api.github.com/repos/contao/test/labels/framework"}],"title":"Salt password hashes in DB with encryption key","closed_at":"2011-11-28T16:16:56Z","html_url":"https://github.com/contao/test/issues/142","url":"https://api.github.com/repos/contao/test/issues/142","milestone":{"state":"closed","created_at":"2011-11-28T15:58:38Z","due_on":null,"closed_issues":9,"creator":{"gravatar_id":"87d2e5aefadcb310f9155df28c2b3582","id":1192057,"url":"https://api.github.com/users/leofeyer","avatar_url":"https://secure.gravatar.com/avatar/87d2e5aefadcb310f9155df28c2b3582?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"leofeyer"},"number":1,"description":"TYPOlight 2.7.0 (minor release)","title":"2.7.0","open_issues":0,"url":"https://api.github.com/repos/contao/test/milestones/1"}},"action":"created","comment":{"created_at":"2011-11-28T16:16:45Z","updated_at":"2011-11-28T16:16:45Z","user":{"gravatar_id":"1c0dba2e2d4914062d95c1f45099537b","id":357895,"url":"https://api.github.com/users/fbender","avatar_url":"https://secure.gravatar.com/avatar/1c0dba2e2d4914062d95c1f45099537b?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"fbender"},"body":"> \"statt also \"is_salted\" abzuspeichern sollte ein neues Feld \"salt\" eingeführt werden, wo der seinerseit auch beliebig lange Salt steht, zum Beispiel selbst ein sha1 von einem zufälligen String. Steht ein Salt drin ist das Passwort auch mit Salt versetzt, wenn nicht dann nicht.\"\nDas ist clever ;).\n\n> \"es gibt leider für die kleinen IDs (bis 12Bit) auch schon fertig berechnete Rainbows für md5 und sha1\"\nKommt darauf an, welches Verfahren eingesetzt wird ;) wenn man z. B. das nimmt:\n\n```\n$password = sha1(sha1($salt.$userid).$password.$salt); \n// oder z. B.:\n$password = sha1(sha1($salt.$userid.$password).$password.$salt); \n```\n\nSomit fallen die bereits vorhandenen hash tables raus - die UserID wird ja noch mit der - damals zufällig festgesetzten - Salt verbunden und somit haben wir nochmal einen riesen Wust an Zahlenzusatz. Ich denke das sollte ausreichen, mehr kann man sowieso nicht machen ... jeder Admin ist ja nochmal zuständig, dass niemand an die DB mit den PW-Hashs drankommt ;).\n\n--- _Originally created on February 16th, 2009, at 07:01pm_","id":2899490,"url":"https://api.github.com/repos/contao/test/issues/comments/2899490"}}