Skip to content
  1. Mar 31, 2008
    • Dries Buytaert's avatar
      - Patch #29706 by pwolanin, solardiz, et al: more secure password hashing. · ed59911f
      Dries Buytaert authored
        This is a big and important patch for Drupal's security.  We are switching
        to much stronger password hashes that are also compatible with the Portable
        PHP password hashing framework.
      
        The new password hashes defeat a number of attacks, including:
      
        - The ability to try candidate passwords against multiple hashes at once.
        - The ability to use pre-hashed lists of candidate passwords.
        - The ability to determine whether two users have the same (or different)
          password without actually having to guess one of the passwords.
      
        Also implemented a pluggable password hashing API (similar to how an alternate
        cache mechanism can be used) to allow developers to readily substitute an
        alternative hashing and authentication scheme.
      
        Thanks all!
      ed59911f
  2. Mar 17, 2008
  3. Mar 11, 2008
  4. Feb 20, 2008
  5. Feb 19, 2008
  6. Feb 17, 2008
  7. Feb 03, 2008
  8. Jan 30, 2008
  9. Jan 27, 2008
  10. Jan 21, 2008
  11. Jan 17, 2008
  12. Jan 10, 2008
  13. Dec 29, 2007
  14. Dec 26, 2007
  15. Dec 20, 2007
  16. Dec 19, 2007
  17. Dec 05, 2007
  18. Nov 26, 2007
  19. Nov 21, 2007
  20. Nov 19, 2007
  21. Nov 14, 2007
  22. Nov 11, 2007
  23. Nov 09, 2007
  24. Oct 25, 2007
  25. Oct 17, 2007
  26. Oct 10, 2007
  27. Oct 02, 2007
  28. Sep 15, 2007
  29. Sep 14, 2007
  30. Sep 12, 2007
  31. Aug 21, 2007