Critical BUG

[ikovacs1465]

Hello Adam,

i have see the script.. use md5 to crypt the password. You know that md5 is vunerable ?

Can you please create immedly a emergency upgrade ? to use a another salt function ? php has include one to create password crypts as well.

regards

Istvan

 

[ysmods]

Whilst I agree that md5 is vulnerable, its only vulnerable if somehow the malicious user was able to find the md5 hashes.

So unless you are using insecure server/script/database passwords I can't see anyway that the malicious user is going to be able to get the hashes.

I did submit an RFC for salted password hashes back in february: http://forum.mfscripts.com/viewtopic.php?f=13&t=410

 

[uploadchest]

MD5 is, for all intents and purposes, secure for the application. You don't have to use md5, you can use sha1() if you want. It won't be easy to transition to a more secure setup because all previous members passwords would require to be reset as MD5 is hashed.

 

[ysmods]

You could sha1() the md5'd passwords which would make it fairly easy to update the passwords in the database.

Even adding a salt to the passwords in the database would be easy with a simple script.

Even better than md5() or sha1() is the crypt() function

 

[ikovacs1465]

uploadchest ?

"MD5 is, for all intents and purposes, secure for the application"

that you mean not really ? sorry but if you not familiar with some security requirements please don't comment anything.

i prefer crypt , but if Adam this not fix i will create a branch for Yetishare.. and modify this then directly template based.

regards

Istvan

 

[ysmods]

If you do modify the code, please remember that you cannot re-distribute any core files modified or un-modified.

You can however provide a tutorial on how users can change the code themselves.

 

[ikovacs1465]

Oh really ? where carry on ? nobody...

Maybe we can talk about some another points, like another Licsenses.

 

[ysmods]

Feel free to contact Adam regarding the product license.

I am just repeating what I was told regarding re-distribution of the files.