gocd/gocd-filebased-authentication-plugin

Add support for other hashing mechanisms

ketan opened this issue · 0 comments

ketan commented

SHA1 as a password hashing mechanism has been deprecated. Industry standard recommendation is bcrypt or PBKDF2.

From this page

What hash algorithm should I use?

DO use:

DO NOT use:

  • Fast cryptographic hash functions such as MD5, SHA1, SHA256, SHA512, RipeMD, WHIRLPOOL, SHA3, etc.
  • Insecure versions of crypt ($1$, $2$, $2x$, $3$).
  • Any algorithm that you designed yourself. Only use technology that is in the public domain and has been well-tested by experienced cryptographers.