{"action":"created","issue":{"url":"https://api.github.com/repos/NerdyMunchkin/itocdc-2015-www/issues/11","labels_url":"https://api.github.com/repos/NerdyMunchkin/itocdc-2015-www/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/NerdyMunchkin/itocdc-2015-www/issues/11/comments","events_url":"https://api.github.com/repos/NerdyMunchkin/itocdc-2015-www/issues/11/events","html_url":"https://github.com/NerdyMunchkin/itocdc-2015-www/issues/11","id":67776847,"number":11,"title":"Use newer hashes in session authentication","user":{"login":"NerdyMunchkin","id":7536422,"avatar_url":"https://avatars.githubusercontent.com/u/7536422?v=3","gravatar_id":"","url":"https://api.github.com/users/NerdyMunchkin","html_url":"https://github.com/NerdyMunchkin","followers_url":"https://api.github.com/users/NerdyMunchkin/followers","following_url":"https://api.github.com/users/NerdyMunchkin/following{/other_user}","gists_url":"https://api.github.com/users/NerdyMunchkin/gists{/gist_id}","starred_url":"https://api.github.com/users/NerdyMunchkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NerdyMunchkin/subscriptions","organizations_url":"https://api.github.com/users/NerdyMunchkin/orgs","repos_url":"https://api.github.com/users/NerdyMunchkin/repos","events_url":"https://api.github.com/users/NerdyMunchkin/events{/privacy}","received_events_url":"https://api.github.com/users/NerdyMunchkin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/NerdyMunchkin/itocdc-2015-www/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-11T11:47:50Z","updated_at":"2015-04-15T15:47:07Z","closed_at":null,"body":"The entire authentication system is flawed, but for completeness I am going to point out this shortcoming.\r\n\r\nIn session.php, the function to generate an authenticated session calculates a hash on the user's email to get a session id. The hash is defined as the following:\r\n\r\nsha1( md5( $user ))\r\n\r\nThe SHA1 hash is deprecated, and not secure enough for continued use. Modern cryptoanalysis of it show that it has become deprecated and should not be in use. MD5 faces the same issue. It was first published in the 90s, and collisions can be generated within a second on a modern computer.\r\n\r\nWe should be using, in my opinion, SHA256 as the hash algorithm for any cryptography purpose in this application. At this time we can safely assume it to be a secure hash for our purpose."},"comment":{"url":"https://api.github.com/repos/NerdyMunchkin/itocdc-2015-www/issues/comments/93456193","html_url":"https://github.com/NerdyMunchkin/itocdc-2015-www/issues/11#issuecomment-93456193","issue_url":"https://api.github.com/repos/NerdyMunchkin/itocdc-2015-www/issues/11","id":93456193,"user":{"login":"NerdyMunchkin","id":7536422,"avatar_url":"https://avatars.githubusercontent.com/u/7536422?v=3","gravatar_id":"","url":"https://api.github.com/users/NerdyMunchkin","html_url":"https://github.com/NerdyMunchkin","followers_url":"https://api.github.com/users/NerdyMunchkin/followers","following_url":"https://api.github.com/users/NerdyMunchkin/following{/other_user}","gists_url":"https://api.github.com/users/NerdyMunchkin/gists{/gist_id}","starred_url":"https://api.github.com/users/NerdyMunchkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NerdyMunchkin/subscriptions","organizations_url":"https://api.github.com/users/NerdyMunchkin/orgs","repos_url":"https://api.github.com/users/NerdyMunchkin/repos","events_url":"https://api.github.com/users/NerdyMunchkin/events{/privacy}","received_events_url":"https://api.github.com/users/NerdyMunchkin/received_events","type":"User","site_admin":false},"created_at":"2015-04-15T15:47:07Z","updated_at":"2015-04-15T15:47:07Z","body":"Hashes have been changed in the patches applied to the authentication branch. Session IDs are now generated by the double SHA256 hash of the user's password."}}