Форуми / Cotonti / Development / Genoa improved security

Thanks for the article link. Now that I've read it, it makes more sense to me. This is exactly the reason why we like to take this thing slowly. It's better to think this thing over before we start implementing something that's insecure by design.

The idea behind storing the salt in a disk file is that it's not stored as plaintext in the database, otherwise it's still useless because a hacker with access to the database would still be able to run a lookup table attack by simply adding the salt before precalculating the lookup table hashes. I understand from the article that a fixed salt like this isn't necessary, since the goal of a salt it to prevent an attacker from pre-calculating hashes from a dictionary. By using a different salt for each password, it becomes impossible to pre-calculate the hashes. An attacker can still use a dictionary, but he'd have to calculate all dictionary hashes individually for each password/salt combination, which would take considerably longer (the lookup table would be multiplied in size by the total number of users).

A big advantage of storing the salt in the database instead of in config.php is the reduced risk of losing the salt (and losing all passwords in the process). It's not uncommon to accidently overwrite config.php and lose the configuration variables stored within. Perhaps we can make the 'fixed salt' optional for extremely security-minded administrators.

PS. As an experiment I've ran a lookup table attack with only ~100k dictionary words on a major Cotonti website and succesfully found the plaintext passwords of almost 15% of users.