#141 Use salted Hashes for storing Passwords in User-database

[Erik Sonnleitner]

I was quite suprised, when I noticed that SubSonic does not encrypt passwords in the user database. Currently, a password is represented by a vector of numeric ASCII/UTF8 values. More precisely, String.utf8HexEncode() is all that is done inside the UserDao.encrypt() method. With respect to what is being done, "encrypt" is suggesting to be way more secure than it actually is.

I honestly think SubSonic should get rid of defacto-plaintext passwords and move to "modern" password storing methods, utilizing cryptographically strong hash functions and salting.

[Anonymous]

After more than two years, this security hole is still there, the bug status is still open, no one has even responded to this bug, let alone assign it to him-/herself, why? No one in his right frame of mind should be even considering saving passwords in plaintext in the database of his software!