You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've been reading the guide and readme a bit, but I haven't seen anything about hashed passwords.
Is there a time table on if/when the user configuration will support having the password in the json file be hashed, for additional server side security? While it is up to the server admin to make sure the server can't be compromised and malicious users getting access to sensitive files, it's also a good idea to make sure the passwords can be hashed in the configurations files, in the possible event that a user happened to use the same or similar password in other places. It shouldn't be too difficult, right? You simply read the password string, quickly check to see if the string is of a certain length, then checks to see if the first 2-3 characters match something on record, and... well, you get the idea.
I'm just unsure if it was already implemented, as there's nothing in the history or logs. Thank you for reading this little issue/enhancement. Have a good day.
The text was updated successfully, but these errors were encountered:
We don't hash the passwords yet as WebIRC is in early stages. This is something that could be done after users can be added dynamically at runtime. For now, I'd recommend using a unique password that you aren't using anywhere else. This is generally a good practice, not only because of plaintext storage.
I've been reading the guide and readme a bit, but I haven't seen anything about hashed passwords.
Is there a time table on if/when the user configuration will support having the password in the json file be hashed, for additional server side security? While it is up to the server admin to make sure the server can't be compromised and malicious users getting access to sensitive files, it's also a good idea to make sure the passwords can be hashed in the configurations files, in the possible event that a user happened to use the same or similar password in other places. It shouldn't be too difficult, right? You simply read the password string, quickly check to see if the string is of a certain length, then checks to see if the first 2-3 characters match something on record, and... well, you get the idea.
I'm just unsure if it was already implemented, as there's nothing in the history or logs. Thank you for reading this little issue/enhancement. Have a good day.
The text was updated successfully, but these errors were encountered: