[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAA7hUgFtVMOpHHSLE=RB9D=PYhpNqtc-mQAFQ160r6dbydOvZg@mail.gmail.com>
Date: Wed, 9 Oct 2013 11:27:51 +0200
From: Raphael Geissert <geissert@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Source of bad password hashing practices? MySQL manual...
On 9 October 2013 01:57, Rich Felker <dalias@...ifal.cx> wrote:
> "Do not store cleartext passwords in your database. If your computer
> becomes compromised, the intruder can take the full list of
> passwords and use them. Instead, use SHA2(), SHA1(), MD5(), or some
> other one-way hashing function and store the hash value."
>
> (http://dev.mysql.com/doc/refman/5.7/en/security-guidelines.html)
They probably don't mention the use of ENCRYPT (think of it as an
alias to crypt(3)) because it is not portable to Windows-based
systems, but I find the following bit quite amusing:
http://sources.debian.net/src/mysql-5.5/5.5.33+dfsg-1/sql/item_strfunc.cc?hl=1877#L1889
(yeah, that's in their implementation of ENCRYPT())
Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
