oss-security - Re: Source of bad password hashing practices? MySQL manual...

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20131009180844.GA7035@hunt>
Date: Wed, 9 Oct 2013 11:08:44 -0700
From: Seth Arnold <seth.arnold@...onical.com>
To: Rich Felker <dalias@...ifal.cx>
Cc: oss-security@...ts.openwall.com
Subject: Re: Source of bad password hashing practices? MySQL
 manual...

On Tue, Oct 08, 2013 at 07:57:52PM -0400, Rich Felker wrote:
> It's come to my attention recently that the MySQL reference manual is
> recommending very poor password hashing practices as part of its
> security guidelines:
> 
>   "Do not store cleartext passwords in your database. If your computer
>   becomes compromised, the intruder can take the full list of
>   passwords and use them. Instead, use SHA2(), SHA1(), MD5(), or some
>   other one-way hashing function and store the hash value."
> 
>   (http://dev.mysql.com/doc/refman/5.7/en/security-guidelines.html)
> 
> With MySQL being one of the major traditional "LAMP stack" components,
> I wonder if this is the source from which many web developers are
> getting their ideas on how to do password hashing. What is the proper
> procedure for publicizing documentation bugs like this which are
> leading to poor security practice, and for getting them fixed?

I don't know if we can realistically assign a CVE number to bad advice
on the Internet :) , but it would be immensely useful if this paragraph
could be updated to say:

   "Do not store cleartext passwords in your database. If your computer
   becomes compromised, the intruder can take the full list of
   passwords and use them. Instead, use PBKDF2, bcrypt, or scrypt to
   compute unique hash values suitable for storing in the database."

A further change that might be nice would change "If your computer becomes
compromised ..." to "When your computer becomes compromised ..." but I
could understand if the MySQL team doesn't share my pessimism and choses
to ignore this small change.

But please, MySQL team, feel free to use my proposed paragraph under
whatever license you wish. The old one has to go.

Thanks

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.