store passwords on disk as hash, not as simple hex encoding
Posted:
Thu Mar 31, 2011 9:12 pmby achoo5000
As of right now the passwords for subsonic users are just hex encodings of the password string, which is easily reversible.
I submit a request that the passwords are stored as a md5 hash that cannot be easily de-encoded.
Posted:
Wed Apr 27, 2011 6:46 amby achoo5000
Here is a java library for doing correct password storing:
http://www.mindrot.org/projects/jBCrypt/
bump for justice
Posted:
Mon Aug 01, 2011 12:09 amby achoo5000
Now that sindre is reading the forums again I thought I'd bump this to the top.
After all these password hacks in the news I thought we would learn you should never store passwords as plaintext (which is what subsonic does essentially).
The syntax for this password encrypting library couldn't be easier.
PS I'm glad that the new beta runs as non-root for Ubuntu, keep up the good work!