change sha1 to crypt_sha512 with some rounds about codeigniter-ion-auth HOT 6 CLOSED

Hey dreamer,

I really appreciate this. The reason I am using the encryption algorithm I am using now is for backwards compatibility with Redux Auth. It seems that Ion Auth has pretty much taken over Redux so backwards compatibility may not be an issue for much longer but then it would be an issue for the existing Ion Auth user base.

The best compromise would be to add this as a config option so existing installs don't break.

One thing I've been wanting to add for awhile is a lock out, a five wrong passwords and you are locked out and must reset by email sort of thing. In your opinion is there any advantage in changing the hashing algorithm over adding a lockout? The only time I could see the advantage is if a hacker gained access to the DB data...

Thanks!

from codeigniter-ion-auth.

IMHO. I would add both. Actually lockout - is what I'm working on right now.
I wouldn't worry about backward compatibility - it's not like it's a commercial app.
You don't owe anything to anyone. If it's better - just implement it.

from codeigniter-ion-auth.

dreamer111: Remember that Ion Auth is the most used auth system around, used in PyroCMS and in several other commercial addons. As Ben is one of the contributors for PyroCMS I would strongly suggest we don't do anything to bust compatibility.

from codeigniter-ion-auth.

dreamer,

I've personally used Ion Auth in several commercial apps and a few enterprise apps plus there is all the Pyro installs that Phil mentioned.

Backwards compatibility doesn't see like a big deal until you need it. Causing hundreds or thousands of existing users to not be able to log in after a library upgrade ends up being a pretty big deal.

If you fork and send me a pull request for the lock out code I'll be glad to merge it in. Just don't add any additional tables, use the users table. And I will think about adding additional encryption options in as a config option at some point in the future.

Thanks!

from codeigniter-ion-auth.

i seriously question "PyroCMS commercial" use. afaik Admin theme doesn't even support ie. also - Phil seem to be a douche.

from codeigniter-ion-auth.

We turned over a few £k since the launch of our store and have over 10,000 installs, so yes it is commercial use. Besides as Ben points out I am not the only one using it, several of our friends (and a lot of the community) uses Ion Auth, it has become the defacto-standard like Redux used to be.

Not sure what your attitude is about, but try to keep the conversation constructive. A config option for this would be fine.

from codeigniter-ion-auth.