|
Hi,
I’ve been reseting my admin password and seen how password hashing is implemented:
public function hash($data)
{
return md5($data);
}
public function validateHash($password, $hash)
{
$hashArr = explode(':', $hash);
switch (count($hashArr)) {
case 1:
return $this->hash($password) === $hash;
case 2:
return $this->hash($hashArr[1] . $password) === $hashArr[0];
}
Mage::throwException('Invalid hash.');
}
What is the point in showing salt and even allowing having password without a salt?
Well, default hash tables won’t work here, but still md5 hacked really easy nowadays when you have salt.
Don’t you think salt should be stored somewhere in config?
And this probably been told a thousand times but why on earth md5 and not sha1?
PS:Sorry if this issue was raised already, but I could find a thread with it.
|
