Some major security improvements related to the latest news on tech feeds
You have probably seen the recent news about database leaks at LinkedIn, Yahoo, etc. So you may be worried what happens to your users if your database is stolen somehow. The good news is that passwords are not stored as plain text but are hashed with MD5. The bad news is that MD5 is rather easy to bruteforce.
So, we made some major improvements to the way passwords are hashed in Cotonti and it is now using SHA256 with random salts by default, provides some hashing options and gives plugin developers an opportunity to implement their own hashing methods. An update is recommended to both Siena and Genoa users. After upgrade, existing user passwords will still be hashed with MD5, but as soon as they change their passwords, new hashing functions will be applied.
The Genoa update 0.6.24 includes one more security patch, so it is highly recommended to update if you let strangers enter your Administration panel.
The Siena update 0.9.11 includes lots of bug fixes and enhancements including Daylight Saving Time support. See release notes for more information.
