Mailing-List: contact notifications-help@ofbiz.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@ofbiz.apache.org
Date: Sun, 18 Dec 2016 17:46:58 +0000 (UTC)
From: "Jacques Le Roux (JIRA)" <jira@apache.org>
To: notifications@ofbiz.apache.org
Message-ID: <JIRA.13028991.1482083202000.548475.1482083218326@Atlassian.JIRA>
In-Reply-To: <JIRA.13028991.1482083202000@Atlassian.JIRA>
References: <JIRA.13028991.1482083202000@Atlassian.JIRA> <JIRA.13028991.1482083202656@arcas>
Subject: [jira] [Created] (OFBIZ-9150) Create a tool to hashes all our OOTB
 passwords using PBKDF2_SHA512
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Sun, 18 Dec 2016 17:46:59 -0000

Jacques Le Roux created OFBIZ-9150:
--------------------------------------

             Summary: Create a tool to hashes all our OOTB passwords using PBKDF2_SHA512
                 Key: OFBIZ-9150
                 URL: https://issues.apache.org/jira/browse/OFBIZ-9150
             Project: OFBiz
          Issue Type: Sub-task
          Components: framework
            Reporter: Jacques Le Roux
            Priority: Minor


Currently we use SHA1 for our OOTB passwords hashes and they are not salted.  If you create new passwords they will still use SHA1 but they will be salted, which is good.

But we should better provide SHA-512 OOTB hashes instead of SHA-1. And use SHA-512 as default encrypting method (even for fields), with at least 10 000 iterations, to lead our users to the best solution.

We should also provide a simple and easy documentation about that. So far we have this discussion http://markmail.org/message/yqybsqzigrqbyxgf
I suggest to improve/enhance https://cwiki.apache.org/confluence/display/OFBIZ/How+to+secure+your+deployment


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)