Re: [jetty-dev] Can someone please shed some light on the security of pa

[Edmond Kemokai <ekemokai@xxxxxxxxxxxxx>]

@Brad

MD5 is a weak hash, which is well known. your point about susceptibility to collision is in itself a good enough reason not to use it.

The password space (mathematically speaking) is vast, even for relatively weak passwords. So if an attacker manages to get their hands on your database it would be much more preferable for them if it was easier to crack the hash (which would be the case for MD5 and UnixCrypt) versus taking wild guesses of all passwords that could possibly map to a given hash.

On Sun, Feb 19, 2017 at 9:29 PM, Brad McEvoy <brad@xxxxxxxxxxxxxxxxxxxx> wrote:

Not specific to Jetty, but my understanding is that MD5 is susceptible to collisions, so someone could find a password other then the user's real password which generates the same MD5.

However, that doesnt actually help an attacker find the user's password.

On 20/02/17 15:24, Edmond Kemokai wrote:

Specifically, it seems jetty only supports MD5 and UnixCrypt as methods for hashing passwords, neither is considered secure (someone correct me on this).

Is the expectation that users who want security will roll their own LoginService implementations and support stronger methods (sha2+,bcrypt)?

_______________________________________________
jetty-dev mailing list
jetty-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/jetty-dev

_______________________________________________
jetty-dev mailing list
jetty-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/jetty-dev