contao/issues — Issue #142: Salt password hashes in DB with encryption key
Author: importer
Created: 2011-11-24 12:17:33+00:00
State: open
Labels: Feature, framework

To increase safety, all passwords in the Database should be salted using the encryption key generated during the installation.

Pseudo:

```
$userPassword = sha1($encryptionKey . $inputPassword);
```

Database dumps won't be useful anymore without the encryption key which prevents identity stealing (or something similar ;) ).

This might only increase the safety when a server has been hacked or an admin "loses" a databse dump but I'd say the small changes are truly worth it.

For further information: http://en.wikipedia.org/wiki/Salt_(cryptography)

I thought this has already been implemented but I just found out it isn't ...

[Download the attachments](http://www.contao.org/tl_files/tickets/142.zip "Download the attachments of this ticket")

--- _Originally created by FloB on September 27th, 2008, at 11:31pm (ID 142)_