Re: PHP: issues managing the password, what is wrong?
On 30/09/2009 11:54, Zdenek Styblik wrote:
I'd say it depends on the type of leak of credentials - if
database is
stolen, or password is sniffed through eg. http [web app] - in the first
case, hashed passwords will buy time; the second - it doesn't matter,
how's the password stored in LDAP - right?
Several different cases here:
1) Database is stolen: the stronger the hash algorithm, the more time
you buy.
2) Password is sniffed in plain text: hash-independant, since the
attacker already has clear text password
3) Brute force attack by attempting to bind to LDAP server: if the hash
only takes 8 characters into account, that makes brute-forcing a lot
easier - limited number of possibilities. Other than that, hashes should
be equivalent in this case, aside from server load.
Of course, there are other considerations, such as password policy
locks, password complexity and of course users with post-it notes.
Back to the original topic though: the way a password is stored is
really only the LDAP server's business. As Howard said, OpenLDAP uses
SSHA by default - unless you notice some performance hit from that,
there's no reason to change it.
Jonathan