User passwords stored as plaintext
Reported by Dhruv M | June 18th, 2009 @ 09:16 PM
This is incredibly insecure, especially since a lot of sensitive information is being transmitted. I recommend PBKDF2, or some strong hashing function (NOT MD5) to implement this.
Comments and changes to this ticket
-
ronin-51336 (at lighthouseapp) June 18th, 2009 @ 10:37 PM
- → State changed from “new” to “resolved”
Passwords are most definitely not stored in plaintext at UniThrive. What led you to that conclusion?
-
Dhruv M June 19th, 2009 @ 01:08 AM
When submitting a forgotten password request, the original password is returned in plaintext. I realize that this does not imply that passwords are not stored in plaintext, but they are certainly stored using some sort of reversible encryption scheme. I find this problematic because, if someone were to gain root access, looking at the code behind the 'forgotten password' script would allow that person to necessarily view all stored passwords with little extra work.
Storing the passwords using a salt + hash function that is not particularly susceptible to rainbow tables would be the most straightforward way to solve the issue. Users who forget their passwords would instead be prompted to reset them.
-
ronin-51336 (at lighthouseapp) June 20th, 2009 @ 08:22 PM
- → State changed from “resolved” to “open”
We are in discussions about whether or not to change our data storage policies based on this request.
-
ronin-51336 (at lighthouseapp) June 21st, 2009 @ 05:50 AM
- → State changed from “open” to “hold”
It has been decided (higher up) to put off changing this to a later revision.
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create new ticket
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile »
This is the main website for Unithrive.org.