Ticket #207 (new enhancement)

Opened 11 months ago

Last modified 11 months ago

Add Solar_Auth_Adapter_Phpass

Reported by: asgentile@… Owned by: pmjones
Priority: security Component: code
Keywords: Cc:

Description

The normal md5 ($salt + $pass) way of password storage is very much lacking and should probably be discouraged. Dynamic salts and adaptive hashes should be the way it is done. In this effort I suggest a new auth adapter that uses a mature solution called phpass found at  http://www.openwall.com/phpass/ which has been picked up by joomla, wordpress, and drupal to name a few. I have added a first attempt for the adapter. However I am unsure if for organization sake it should be in its own untouched area, or perhaps as Solar_Auth_Adapter_Sql_Phpass. Anywho I don't particular feel good about changing security related code in any way as mistakes aren't usually discovered until way down the road and is usually because of exploitation. I have however changed it to Solar convention ...it could also use some PEAR standard love. Let me know what you think.

Attachments

Solar_Auth_Adapter_Phpass.php Download (11.5 KB) - added by pmjones 10 months ago.
Test_Solar_Auth_Adapter_Phpass.php Download (1.6 KB) - added by pmjones 10 months ago.

Change History

Changed 11 months ago by asgentile@…

hmm i don't have delete access to replace the file for a type $this->passwd to $this->_passwd

Changed 10 months ago by pmjones

Changed 10 months ago by pmjones

Add/Change #207 (Add Solar_Auth_Adapter_Phpass)

Author


E-mail address and user name can be saved in the Preferences.


Action
as new
 
Note: See TracTickets for help on using tickets.