oss-sec mailing list archives
Re: Source of bad password hashing practices? MySQL manual...
From: Seth Arnold <seth.arnold () canonical com>
Date: Wed, 9 Oct 2013 11:08:44 -0700
On Tue, Oct 08, 2013 at 07:57:52PM -0400, Rich Felker wrote:
It's come to my attention recently that the MySQL reference manual is recommending very poor password hashing practices as part of its security guidelines: "Do not store cleartext passwords in your database. If your computer becomes compromised, the intruder can take the full list of passwords and use them. Instead, use SHA2(), SHA1(), MD5(), or some other one-way hashing function and store the hash value." (http://dev.mysql.com/doc/refman/5.7/en/security-guidelines.html) With MySQL being one of the major traditional "LAMP stack" components, I wonder if this is the source from which many web developers are getting their ideas on how to do password hashing. What is the proper procedure for publicizing documentation bugs like this which are leading to poor security practice, and for getting them fixed?
I don't know if we can realistically assign a CVE number to bad advice on the Internet :) , but it would be immensely useful if this paragraph could be updated to say: "Do not store cleartext passwords in your database. If your computer becomes compromised, the intruder can take the full list of passwords and use them. Instead, use PBKDF2, bcrypt, or scrypt to compute unique hash values suitable for storing in the database." A further change that might be nice would change "If your computer becomes compromised ..." to "When your computer becomes compromised ..." but I could understand if the MySQL team doesn't share my pessimism and choses to ignore this small change. But please, MySQL team, feel free to use my proposed paragraph under whatever license you wish. The old one has to go. Thanks
Attachment:
signature.asc
Description: Digital signature
Current thread:
- Source of bad password hashing practices? MySQL manual... Rich Felker (Oct 08)
- Re: Source of bad password hashing practices? MySQL manual... gremlin (Oct 09)
- Re: Source of bad password hashing practices? MySQL manual... Alex Gaynor (Oct 09)
- Re: Source of bad password hashing practices? MySQL manual... Raphael Geissert (Oct 09)
- Re: Source of bad password hashing practices? MySQL manual... Seth Arnold (Oct 09)
- RE: Source of bad password hashing practices? MySQL manual... Christey, Steven M. (Oct 09)
- Re: Source of bad password hashing practices? MySQL manual... Chris Palmer (Oct 09)
- Re: Source of bad password hashing practices? MySQL manual... Kurt Seifried (Oct 09)
- Re: Source of bad password hashing practices? MySQL manual... Jeremy Stanley (Oct 09)
- RE: Source of bad password hashing practices? MySQL manual... Christey, Steven M. (Oct 09)
- Re: Source of bad password hashing practices? MySQL manual... gremlin (Oct 09)
- Re: Source of bad password hashing practices? MySQL manual... John Haxby (Nov 07)