« Extending the postbit/poster info
Password Hashing
Template skeleton! »

ethankcvds

  • Good news I finally have a new computer. Bad news I have to RMA the memory got a bad stick of RAM.
  • Posts: 35
Password Hashing
« on November 28th, 2011, 07:44 PM »
Any plans of changing the way passwords are hashed? If so to which one?

(click to show/hide)
I had an other idea that I wanted post but I forgot.(Need to start writing things down.) :bah:

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: Password Hashing
« Reply #1, on November 28th, 2011, 08:34 PM »
None at this time. SHA1 of lowercase username and password should be enough for now, and the password upgraded accepts plenty more types...

If you're thinking to something else, what and why?
When we unite against a common enemy that attacks our ethos, it nurtures group solidarity. Trolls are sensational, yes, but we keep everyone honest. | Game Memorial

ethankcvds

  • Good news I finally have a new computer. Bad news I have to RMA the memory got a bad stick of RAM.
  • Posts: 35
Re: Password Hashing
« Reply #2, on November 28th, 2011, 09:02 PM »
Quote from Arantor on November 28th, 2011, 08:34 PM
None at this time. SHA1 of lowercase username and password should be enough for now, and the password upgraded accepts plenty more types...

If you're thinking to something else, what and why?
Ah okay. Something I had planned to use was either sha256 or sha512.

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: Password Hashing
« Reply #3, on November 28th, 2011, 09:57 PM »
For what reason, though? There are also side consequences, like performance and compatibility to contend with.

ethankcvds

  • Good news I finally have a new computer. Bad news I have to RMA the memory got a bad stick of RAM.
  • Posts: 35
Re: Password Hashing
« Reply #4, on November 28th, 2011, 10:08 PM »
Quote from Arantor on November 28th, 2011, 09:57 PM
For what reason, though? There are also side consequences, like performance and compatibility to contend with.
The only reason that I can think of is that at the age that sha-1 is how much longer is it before it becomes like md5 cryptographically un-secure.

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: Password Hashing
« Reply #5, on November 28th, 2011, 10:16 PM »
It's still prohibitive to build rainbow tables of per-user salted hashes, though.
Posted: November 28th, 2011, 10:12 PM

Also, don't forget that users don't usually care about security if it inhibits other things, such as performance.
Re: Password Hashing
« Reply #6, on November 29th, 2011, 04:10 PM »
I should also note that if we made anything above SHA1 default, that's *even more* users who will have to go through password-upgrading on conversion, a factor that won't exactly endear convertees to Wedge, though it will be entirely accurate in that it will indeed upgrade security.

ethankcvds

  • Good news I finally have a new computer. Bad news I have to RMA the memory got a bad stick of RAM.
  • Posts: 35
Re: Password Hashing
« Reply #7, on November 29th, 2011, 04:40 PM »
Quote from Arantor on November 29th, 2011, 04:10 PM
I should also note that if we made anything above SHA1 default, that's *even more* users who will have to go through password-upgrading on conversion, a factor that won't exactly endear convertees to Wedge, though it will be entirely accurate in that it will indeed upgrade security.
Though I do have an other idea besides SHA256 and SHA512. During the install have it set so that the person can choose which hashing algorithm they want to use setting SHA1 as default and provide a note that states if converting from something like SMF 2.0 that they should use SHA1. Though if you still see fit not to change it at this point in time I can make the changes myself when wedge comes out.

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: Password Hashing
« Reply #8, on November 29th, 2011, 06:19 PM »
Bad idea. It will cause more support issues, more confusion among users and so on, and most people will leave it off if they're coming from SMF 2.

You do realise that there are much more significant things to be concerned with in terms of security than brute-forcing individually salted and hashed passwords, right?

(Long story short: you're asking us to implement something that virtually just you is interested in...)
« Extending the postbit/poster info
Template skeleton! »