Mailing-List: contact jspwiki-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: jspwiki-dev@incubator.apache.org
Message-ID: <1552104126.1210526875630.JavaMail.jira@brutus>
Date: Sun, 11 May 2008 10:27:55 -0700 (PDT)
From: "Janne Jalkanen (JIRA)" <jira@apache.org>
To: jspwiki-dev@incubator.apache.org
Subject: [jira] Commented: (JSPWIKI-20) Password hash should be salted
In-Reply-To: <2849133.1194205070952.JavaMail.jira@brutus>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/JSPWIKI-20?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12595923#action_12595923 ] 

Janne Jalkanen commented on JSPWIKI-20:
---------------------------------------

I would like to get this in somehow pretty soon.  Andrew, opinions?

> Password hash should be salted
> ------------------------------
>
>                 Key: JSPWIKI-20
>                 URL: https://issues.apache.org/jira/browse/JSPWIKI-20
>             Project: JSPWiki
>          Issue Type: Improvement
>          Components: Authentication&Authorization
>    Affects Versions: 2.5.139-beta
>            Reporter: Janne Jalkanen
>            Assignee: Janne Jalkanen
>             Fix For: 2.8
>
>         Attachments: jspwiki-20.patch
>
>
> The password hash is calculated as a direct SHA1-digest of the password.  Unfortunately this means that it's vulnerable to brute-force attacks - there are many web sites which store SHA1 hashes of common passwords.  The key space in most languages is pretty small... So the password should really be properly salted with preferably a long, random string.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.