Use a salt and better hash algorithm [#715208]

In Drupal 7 we no longer use md5 unless it's the worst hash available. This module could do something similar.

See http://drupal.org/node/29706#comment-789963 and http://drupal.org/project/salt and http://drupal.org/project/phpass for more ideas on how to make the storage of the password more secure.

Comments

Comment #1

hefox commented 16 February 2010 at 15:41

Thanks, and subscribing myself to remember.

When I started it, I had some initial code for variable storage possibilities, but decided to leave wait. I think I want to do it in some way where the storage (database columns, storing,etc.) is sorta.. pluggable. Perhaps a hook that returns keyed information with what to do when presav-ing, etc.

Comment #2

hefox commented 18 February 2010 at 04:23

Status:

Active

» Postponed

There's now a basic hook for declaring different password storage methods, with selection on field settings form.

I've opened an issue queue with phpass here #717800: Provide wrapper/api module for reusability with other modules to see if they're willing to make an api module, to keep this module relatively clean and ...not repeat code.

Hmm, salt module does a site wide salt; from what I remember salts are usually per password, so I don't think I'd go with that. I may do a simply (but not as simple) salt systems, but I'm go wait and see what phpass says.