Skip to content
  1. Nov 30, 2020
  2. Nov 09, 2020
  3. May 24, 2019
  4. Aug 13, 2018
  5. Jan 23, 2018
  6. Mar 24, 2015
  7. Nov 05, 2014
  8. Oct 07, 2014
  9. Aug 14, 2014
  10. Aug 13, 2014
  11. Jun 26, 2014
  12. Jun 05, 2014
  13. May 05, 2014
  14. Jan 24, 2014
  15. Dec 22, 2013
  16. Mar 27, 2013
  17. Mar 17, 2013
  18. Nov 24, 2012
  19. Nov 07, 2011
  20. Nov 01, 2011
  21. Feb 25, 2011
  22. May 01, 2010
  23. Feb 26, 2009
  24. Feb 18, 2009
  25. Jan 13, 2009
  26. Dec 20, 2008
  27. Sep 20, 2008
  28. Mar 31, 2008
    • Dries Buytaert's avatar
      - Patch #29706 by pwolanin, solardiz, et al: more secure password hashing. · ed59911f
      Dries Buytaert authored
        This is a big and important patch for Drupal's security.  We are switching
        to much stronger password hashes that are also compatible with the Portable
        PHP password hashing framework.
      
        The new password hashes defeat a number of attacks, including:
      
        - The ability to try candidate passwords against multiple hashes at once.
        - The ability to use pre-hashed lists of candidate passwords.
        - The ability to determine whether two users have the same (or different)
          password without actually having to guess one of the passwords.
      
        Also implemented a pluggable password hashing API (similar to how an alternate
        cache mechanism can be used) to allow developers to readily substitute an
        alternative hashing and authentication scheme.
      
        Thanks all!
      ed59911f