concrete5/concrete5 — pull request #1578 by bdsl (2014-02-01 12:53:25+00:00)
Title: Introduce a more secure password hashing system, based on phpass

Currently Concrete5 stores md5 hashes of user passwords, 'salted' with a single site-wide salt. These hashes would be relatively easy to crack in many cases.

This pull request would make the password hashes from the database of a site running Concrete5 a lot less useful to someone trying to obtain the users' passwords, as password cracking will be many times slower.

I have downloaded the phpass password hashing library from http://openwall.com/phpass/ and added a copy to concrete5. phpass describes itself as public domain, and is widely recommended.

I then replaced the existing password hashing code in concrete5 with calls to phpass's PasswordHash and CheckPassword functions.

I have added an option in the settings to control how much computation the password hashing and checking requires. If this is too high then users may notice the wait, but if it is too slow then passwords will be too easy to crack.

Users with pre-existing saved passwords will automatically have their passwords re-hashed in a more secure way the first time they log in after this pull request is merged.

I haven't used the site wide salt stored in PASSWORD_SALT, because I don't think it adds much to security, but I also haven't removed it. I noticed it is used by some other parts of concrete5, so the name is now a little misleading.

I also increased that maximum allowed password length from 64 characters to 128, although I'm not sure if a maximum is necessary.

I removed the rule that bans certain characters from use in passwords.

http://www.concrete5.org/developers/bugs/5-6-2-1/more-secure-password-hashing/