Re: Ponder: Password.
Ramsey Gurley <[email protected]>
| Newsgroups | gmane.comp.web.webobjects.wonder-disc |
|---|---|
| Message-ID | <[email protected]> |
The bcrypt password is salted. To answer your earlier question, the code is in ERUsers.java. I didn't make a way to replace that logic because MD5 hashes are what got LinkedIn in so much trouble :-) Ramsey On Dec 22, 2012, at 11:11 AM, James Cicenia wrote: > I am bridging two databases. The other one stores the user / password. > I then do a REST call to sync the user tables. The other uses a MD hash > with salt key... password:salt > > So, basically, we want to encrypt the password with an appended salt. > James > > > On Dec 22, 2012, at 12:02 PM, Ramsey Gurley <[email protected]> wrote: > >> How do you plan to encode it? >> >> It's using bcrypt, so that should be plenty safe. You can crank up the work value using properties too. >> >> er.users.ERUsers.logRounds=13 >> >> Default is 13. Max is 30. Each increment takes about twice as much time to hash. On my 2011 MBA, 13 takes about one second. Given that, a value of 30 would take it about 5 weeks. Plenty of room to grow there. >> >> Ramsey >> >> On Dec 22, 2012, at 10:48 AM, James Cicenia wrote: >> >>> I want to do my encoding of the password... where is that set... can I subclass it? >>> >>> Thanks >>> >>> >>> >>> ------------------------------------------------------------------------------ >>> LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial >>> Remotely access PCs and mobile devices and provide instant support >>> Improve your efficiency, and focus on delivering more value-add services >>> Discover what IT Professionals Know. Rescue delivers >>> http://p.sf.net/sfu/logmein_12329d2d >>> _______________________________________________ >>> Wonder-disc mailing list >>> [email protected] >>> https://lists.sourceforge.net/lists/listinfo/wonder-disc >> > > ------------------------------------------------------------------------------ > LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial > Remotely access PCs and mobile devices and provide instant support > Improve your efficiency, and focus on delivering more value-add services > Discover what IT Professionals Know. Rescue delivers > http://p.sf.net/sfu/logmein_12329d2d_______________________________________________ > Wonder-disc mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/wonder-disc ------------------------------------------------------------------------------ LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and focus on delivering more value-add services Discover what IT Professionals Know. Rescue delivers http://p.sf.net/sfu/logmein_12329d2d _______________________________________________ Wonder-disc mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/wonder-disc