{"issue":{"created_at":"2011-11-29T04:37:16Z","state":"open","updated_at":"2011-11-29T04:37:24Z","user":{"gravatar_id":"1c0dba2e2d4914062d95c1f45099537b","id":357895,"url":"https://api.github.com/users/fbender","avatar_url":"https://secure.gravatar.com/avatar/1c0dba2e2d4914062d95c1f45099537b?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"fbender"},"comments":7,"body":"To increase safety, all passwords in the Database should be salted using the encryption key generated during the installation.\n\nPseudo:\n\n```\n$userPassword = sha1($encryptionKey . $inputPassword);\n```\n\nDatabase dumps won't be useful anymore without the encryption key which prevents identity stealing (or something similar ;) ).\n\nThis might only increase the safety when a server has been hacked or an admin \"loses\" a databse dump but I'd say the small changes are truly worth it.\n\nFor further information: http://en.wikipedia.org/wiki/Salt_(cryptography)\n\n\nI thought this has already been implemented but I just found out it isn't ...\n\n[Download the attachments](http://www.contao.org/tl_files/tickets/142.zip \"Download the attachments of this ticket\")\n\n--- _Originally created on September 27th, 2008, at 11:31pm (ID 142)_","assignee":{"gravatar_id":"87d2e5aefadcb310f9155df28c2b3582","id":1192057,"url":"https://api.github.com/users/leofeyer","avatar_url":"https://secure.gravatar.com/avatar/87d2e5aefadcb310f9155df28c2b3582?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"leofeyer"},"labels":[{"name":"Feature","color":"4183c4","url":"https://api.github.com/repos/contao/test/labels/Feature"},{"name":"framework","color":"e6e6e6","url":"https://api.github.com/repos/contao/test/labels/framework"}],"id":2377236,"number":142,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"title":"Salt password hashes in DB with encryption key","closed_at":null,"html_url":"https://github.com/contao/test/issues/142","url":"https://api.github.com/repos/contao/test/issues/142","milestone":{"created_at":"2011-11-29T04:17:58Z","state":"open","closed_issues":8,"due_on":null,"creator":{"gravatar_id":"87d2e5aefadcb310f9155df28c2b3582","id":1192057,"url":"https://api.github.com/users/leofeyer","avatar_url":"https://secure.gravatar.com/avatar/87d2e5aefadcb310f9155df28c2b3582?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"leofeyer"},"number":1,"title":"2.7.0","description":"TYPOlight 2.7.0 (minor release)","url":"https://api.github.com/repos/contao/test/milestones/1","open_issues":1}},"action":"created","comment":{"created_at":"2011-11-29T04:37:24Z","updated_at":"2011-11-29T04:37:24Z","user":{"gravatar_id":"1c0dba2e2d4914062d95c1f45099537b","id":357895,"url":"https://api.github.com/users/fbender","avatar_url":"https://secure.gravatar.com/avatar/1c0dba2e2d4914062d95c1f45099537b?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"fbender"},"body":"Is it possible to implement this feature earlier for backend users?\n\nBTW: I think that using sha1() twice is a bit less secure than using sha1($salt.$pw) ...\n\n--- _Originally created on October 22nd, 2008, at 12:01pm_","id":2912598,"url":"https://api.github.com/repos/contao/test/issues/comments/2912598"}}