Moodle in English: md5crypt considered unsafe

Lounge

md5crypt considered unsafe

◄ Using Modified Files
Virtual Teams ►

This discussion has been locked because a year has elapsed since the last post. Please start a new discussion topic.

md5crypt considered unsafe

by L Cramer - Friday, June 8, 2012, 8:43 PM

In light of passwords from LinkedIn and eHarmony being cracked and leaked, it has been announced that md5crypt is no longer considered safe (http://phk.freebsd.dk/sagas/md5crypt_eol.html).

I noticed that the Moodle docs say that Moodle uses md5 to encrypt user passwords: http://docs.moodle.org/19/en/Password_salting

Is there any recommended action to take?

Re: md5crypt considered unsafe

by Tim Hunt - Saturday, June 9, 2012, 4:23 AM

As http://docs.moodle.org/19/en/Password_salting says, use a good salt. That works-around most of the weaknesses in MD5.

Average of ratings: -

◄ Using Modified Files
Virtual Teams ►