contao/import — Issue #3225: SHA1 + salt appearantly does not provide best security anymore. Solution: bcrypt
Author: importer
Created: 2011-11-29 21:07:55+00:00
State: open
Labels: Accepted, Feature, framework

Hi,

upon the recent security issues worldwide a discussion about best practices on how to store passwords ensued.
Appearantly the Contao-way is not the best practice anymore since cpus have become so fast.
But there is a new best practice which is to use bcrypt:
http://codahale.com/how-to-safely-store-a-password/
http://www.marco.org/2011/06/29/simple-php-bcrypt-class-phpass

Depending on how the passwords are stored in Contao today this is worth considering to implement?

Best,
Kahlil

Related issues: #3279

--- _Originally created by kahlil on July 1st, 2011, at 11:16am (ID 3225)_