Sylius: Use BCRYPT instead of SHA512

[Symfomany]

It's recommanded to use BCRYPT(most recents) instead of SHA512 for encoders to encode password in security

http://symfony.com/fr/doc/current/reference/configuration/security.html#utiliser-l-encodeur-bcrypt

[Symfomany]

If your users have a password, then we recommend encoding it using the bcrypt encoder, instead of the
traditional SHA-512 hashing encoder. The main advantages of bcrypt are the inclusion of a salt value to
protect against rainbow table attacks, and its adaptive nature, which allows to make it slower to remain
resistant to brute-force search attacks.
With this in mind, here is the authentication setup from our application, which uses a login form to load
users from the database:

[koemeet]

I am using bcrypt too with Sylius and wanted to mention that you want to use setPassword (instead of setPlainPassword) in test fixtures to skip the long encryption and so speed up the tests. Are there any plans to make Sylius use bcrypt by default?

[koemeet]

@pjedrzejewski Any plans on introducing this?

[stale[bot]]

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in a week if no further activity occurs. Thank you for your contributions.

[teohhanhui]

This is a security risk. :disappointed:

[teohhanhui]

https://security.stackexchange.com/questions/52041/is-using-sha-512-for-storing-passwords-tolerable

[psihius]

Sylius does not use password_hash to store passwords?

It should...

[pamil]

Yeah, it would be great to have it in 1.2, but we have to provide the full migration path for existing users.

[pamil]

I've opened #9560 to coordinate further efforts, let's make it happen in v1.3.0 release 🎉