[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20131008235752.GA14425@brightrain.aerifal.cx>
Date: Tue, 8 Oct 2013 19:57:52 -0400
From: Rich Felker <dalias@...ifal.cx>
To: oss-security@...ts.openwall.com
Subject: Source of bad password hashing practices? MySQL manual...
It's come to my attention recently that the MySQL reference manual is
recommending very poor password hashing practices as part of its
security guidelines:
"Do not store cleartext passwords in your database. If your computer
becomes compromised, the intruder can take the full list of
passwords and use them. Instead, use SHA2(), SHA1(), MD5(), or some
other one-way hashing function and store the hash value."
(http://dev.mysql.com/doc/refman/5.7/en/security-guidelines.html)
With MySQL being one of the major traditional "LAMP stack" components,
I wonder if this is the source from which many web developers are
getting their ideas on how to do password hashing. What is the proper
procedure for publicizing documentation bugs like this which are
leading to poor security practice, and for getting them fixed?
Rich
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
