{"action":"created","issue":{"url":"https://api.github.com/repos/redaxo/redaxo/issues/448","labels_url":"https://api.github.com/repos/redaxo/redaxo/issues/448/labels{/name}","comments_url":"https://api.github.com/repos/redaxo/redaxo/issues/448/comments","events_url":"https://api.github.com/repos/redaxo/redaxo/issues/448/events","html_url":"https://github.com/redaxo/redaxo/issues/448","id":116732995,"number":448,"title":"sha1 passwortverschlüsselung","user":{"login":"staabm","id":120441,"avatar_url":"https://avatars.githubusercontent.com/u/120441?v=3","gravatar_id":"","url":"https://api.github.com/users/staabm","html_url":"https://github.com/staabm","followers_url":"https://api.github.com/users/staabm/followers","following_url":"https://api.github.com/users/staabm/following{/other_user}","gists_url":"https://api.github.com/users/staabm/gists{/gist_id}","starred_url":"https://api.github.com/users/staabm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/staabm/subscriptions","organizations_url":"https://api.github.com/users/staabm/orgs","repos_url":"https://api.github.com/users/staabm/repos","events_url":"https://api.github.com/users/staabm/events{/privacy}","received_events_url":"https://api.github.com/users/staabm/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/redaxo/redaxo/labels/Enhancement","name":"Enhancement","color":"02e10c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-11-13T09:33:30Z","updated_at":"2015-11-13T17:42:21Z","closed_at":null,"body":"Aktuell verwenden wir vom client zum server eine sha1 verschlüsselung zum pre-hashen der Passwörter.\r\n\r\nDa SHA1 mittlerweile als geknackt gilt sollten wir ggf. nochmal die Verschlüsselung wechseln. Da wir aber im Nachgang die Passwörter sowieso nochmal hashen ist es nicht sooo wichtig."},"comment":{"url":"https://api.github.com/repos/redaxo/redaxo/issues/comments/156497934","html_url":"https://github.com/redaxo/redaxo/issues/448#issuecomment-156497934","issue_url":"https://api.github.com/repos/redaxo/redaxo/issues/448","id":156497934,"user":{"login":"staabm","id":120441,"avatar_url":"https://avatars.githubusercontent.com/u/120441?v=3","gravatar_id":"","url":"https://api.github.com/users/staabm","html_url":"https://github.com/staabm","followers_url":"https://api.github.com/users/staabm/followers","following_url":"https://api.github.com/users/staabm/following{/other_user}","gists_url":"https://api.github.com/users/staabm/gists{/gist_id}","starred_url":"https://api.github.com/users/staabm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/staabm/subscriptions","organizations_url":"https://api.github.com/users/staabm/orgs","repos_url":"https://api.github.com/users/staabm/repos","events_url":"https://api.github.com/users/staabm/events{/privacy}","received_events_url":"https://api.github.com/users/staabm/received_events","type":"User","site_admin":false},"created_at":"2015-11-13T17:42:21Z","updated_at":"2015-11-13T17:42:21Z","body":"> Klar, SSL ist am besten, erzwingen sollten wir es aber nicht (finde ich). Aber empfehlen.\r\n\r\nVllt könnte man im customizer eine option einbauen die es verbietet das Backend ohne https aufzurufen.\r\n\r\n> Das heißt, sollten wir das Pre-Hashen lieber wieder ganz entfernen?\r\nEin schlecht gehashtes passwort ist besser als eines im klartext :-). Im besten fall könnte man das passwort bereits clientseitig vollständig so hashen wie wir es für die db brauchen."}}