On Friday 08 June 2012 11:41 Andreas Schneider wrote: > On Friday 08 June 2012 10:40:57 Thomas Tanghus wrote: > > On Friday 08 June 2012 10:15 Andreas Schneider wrote: > > > You know there is this rocket sience technology from the 70ies. It is > > > called salt in cryptography. I suggested several times to use salting in > > > owncloud but we still don't have it. > > > > > > First linkedin: > > > http://www.h-online.com/security/news/item/LinkedIn-confirms-that-user- > > > passwords-were-compromised-1612554.html > > > > > > then last.fm: > > > http://www.lastfm.de/passwordsecurity > > > > > > > > > next: your owncloud installation ... > > > > Now I don't know much about cryptography, but I read the code, followed > > the > > password, and to me it looks like you're spreading FUD: > > > > https://gitorious.org/owncloud/owncloud/blobs/master/3rdparty/phpass/Passw > > or dHash.php#line208 > > Sorry, you're right. > > $2a$08$lh85qKaF6CVi.azfbThI4.qbLZK9vw0XaLHWr616JbH... > > looks like the first part is the random salt and the second is the hash, but > why isn't simply bcrypt used?
As far as I understand phpass implements bcrypt if it is not available: http://www.openwall.com/phpass/ -- Med venlig hilsen / Best Regards Thomas Tanghus _______________________________________________ Owncloud mailing list [email protected] https://mail.kde.org/mailman/listinfo/owncloud
