CMSMS Salted Passwords - Design Flaw?

General project discussion. NOT for help questions.
Locked
Njit
Forum Members
Forum Members
Posts: 55
Joined: Wed Jun 25, 2014 9:03 am

CMSMS Salted Passwords - Design Flaw?

Post by Njit »

I was curious how CMSMS was salting the passwords. I found out that it is attaching a static variable as a salt to the password.

Re-using salt is not among best practices:
Salt Reuse

A common mistake is to use the same salt in each hash. Either the salt is hard-coded into the program, or is generated randomly once. This is ineffective because if two users have the same password, they'll still have the same hash. An attacker can still use a reverse lookup table attack to run a dictionary attack on every hash at the same time. They just have to apply the salt to each password guess before they hash it. If the salt is hard-coded into a popular product, lookup tables and rainbow tables can be built for that salt, to make it easier to crack hashes generated by the product.

A new random salt must be generated each time a user creates an account or changes their password.
There are excellent examples available of how to implement this properly. Maybe do it right in version 2?

https://crackstation.net/hashing-security.htm
Locked

Return to “General Discussion”