Verdaccio: [SECURITY] Insecure password hashing

Created on 18 May 2017 · 4Comments · Source: verdaccio/verdaccio

I saw sha1 is used for hashing the password, yet it's a deprecated insecure hashing algorithm, next to that it's not meant for hashing passwords!!!
If the above wasn't bad enough, you don't even use a salt --> https://github.com/verdaccio/verdaccio/blob/6d8d05b0ccbedcf38868e65c226400c66783a4f2/lib/plugins/htpasswd/utils.js#L57

all

use a hashing algorithm made for password hashing: (pbkdf2, bcrypt, scrypt).

I would suggest bcrypt (npm bcrypt), It will automatically take care of adding a salt!

get your crypto together this app is highly insecure currently

fixed auth outdated feature request

Source

rmi7

All 4 comments

I think the code is just confusing and should probably be re-written.

If you trace through what actually happens, crypt3 is required, and used by default, and that uses sha512 with a salt. So it is secure. Just needs a re-write for clarity.