Skip to content

Drop support & delete all sha1/md5 passwords

chandi requested to merge remove-legacy-passwords into master

What does this MR do?

currently, there are still a lot of passwords stored in md5 and sha1, mostly by uses which haven't logged in since the change, so that there password could not get rehashed with argon2 yet.

This MR removes the support of these passwords which leads to..

  • User need to use the Passwort vergessen? feature to get a new password, which in my opinion is okay, since it is normal to have forgotten your password more than 5 years since the last login anyway.
  • We can finally stop storing these easy crackable passwords.

numbers

 51.874 sha1 passwords (used until 2014-12-12)
105.898 md5 passwords (used until 2018-02-xx)

How confident are you it won't break things if deployed?

pretty

Links to related issues

Checklist

  • added a test, or explain why one is not needed/possible...
  • no unrelated changes
  • asked someone for a code review
  • joined #foodsharing-beta channel at https://slackin.yunity.org
  • added an entry to CHANGELOG.md (description, merge request link, username(s))
  • Once your MR has been merged, you are responsible to update the #foodsharing-beta Slack channel about what has been changed here. They will test your work in different browsers, roles or other settings
Edited by Peter Tönnies

Merge request reports