You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hey, I just noticed that the passwords are stored in plain-hashed format using sha256.
First off, it's awesome that it doesn't just store them in plain. However, when two users have the same password this results in the very same hash.
That's why in “real” OSes they salt the password. A two digit number that is prepended to the password before hashing and stored in plain alongside the hash is enough to make the system an awful lot stronger 😏.
I'd open a pull request if I was better in Lua programming (I'm a C fanboy). So if someone wants to give this a try before I do (probably not very soon), feel free to do so.
The text was updated successfully, but these errors were encountered:
Hey, I just noticed that the passwords are stored in plain-hashed format using sha256.
First off, it's awesome that it doesn't just store them in plain. However, when two users have the same password this results in the very same hash.
That's why in “real” OSes they salt the password. A two digit number that is prepended to the password before hashing and stored in plain alongside the hash is enough to make the system an awful lot stronger 😏.
I'd open a pull request if I was better in Lua programming (I'm a C fanboy). So if someone wants to give this a try before I do (probably not very soon), feel free to do so.
The text was updated successfully, but these errors were encountered: