Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-3104

Use a random salt for SSHA password encoding

    XMLWordPrintable

Details

    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

    Description

      LdapSshaPasswordEncoder uses a site-wide salt value. This is enough to prevent cracking passwords with hashes from another instance, but random salt would improve resistance to a site-wide attempt at password cracking, as well as hiding cases of password collision between users.

      Attachments

        Issue Links

          blocks

          Suggestion - CWD-3105 Remove TokenSeed now it's no longer used

          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. CWD-3095 Add default salt generation when a PropertyManager has not been injected in the ssha password encoder

          • Medium - Medium priority issues
          • Closed
          mentioned in

          Wiki Page Loading...

          Activity

            People

              jwalton joe
              jwalton joe
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: