Ticket #207 (new enhancement)
Add Solar_Auth_Adapter_Phpass
| Reported by: | asgentile@… | Owned by: | pmjones |
|---|---|---|---|
| Priority: | security | Component: | code |
| Keywords: | Cc: |
Description
The normal md5 ($salt + $pass) way of password storage is very much lacking and should probably be discouraged. Dynamic salts and adaptive hashes should be the way it is done. In this effort I suggest a new auth adapter that uses a mature solution called phpass found at http://www.openwall.com/phpass/ which has been picked up by joomla, wordpress, and drupal to name a few. I have added a first attempt for the adapter. However I am unsure if for organization sake it should be in its own untouched area, or perhaps as Solar_Auth_Adapter_Sql_Phpass. Anywho I don't particular feel good about changing security related code in any way as mistakes aren't usually discovered until way down the road and is usually because of exploitation. I have however changed it to Solar convention ...it could also use some PEAR standard love. Let me know what you think.

