Password Log On

Password Log On

7.9k Downloads

[Feature request] Secure password storage

LukeHuckman opened this issue ยท 1 comments

commented

Is your feature request related to a problem? Please describe.
The passwords are stored in clear text on the server, which could pose a security risk.

Describe the solution you'd like
I suggest implementing a hashing algorithm with salt to encrypt the passwords.

commented

I have considered using encryption before, but did not do so for 3 reasons.

  1. I did not see any practical need for encryption. The passwords are stored on the server, and if someone can get the passwords by accessing the server, you have bigger issues to deal with than stolen passwords for server login.
  2. It adds complexity. Admins that may want to retrieve the password for users will be unable to figure out the password and pass it back to the user. (Although, this does add security against admin abuse).
  3. Most importantly, I do not have experience with encryption, and it is more than likely that I mess this up.

While PRs could solve the 3rd reason (and I would most likely merge a PR for encryption), I would like to discourage anyone from doing a PR as a I am going to start a v2.0 rewrite soon.

Sorry, as I know that this isn't the answer you were looking for.