Gregg Pollack
Olivier Lacan
Insecure Passwords
It’s been a bad week for passwords. LinkedIn, eHarmony, and a bunch of other major sites have been caught with their pants down over the last few months by hackers who exploited some rookie mistakes
Many of these breaches were due to password either stored in plain text or not salted when they were hashed.
Richard Schneeman from Heroku goes over the basic solutions to increase password security in a Rails app in a great blog post he published a few days ago. He shows how a simple solution like Devise can allow you to turn a database full of unhashed & unsalted passwords into a secure one gradually and without asking users to reset them.
Instead of forcing users to change their passwords all at once, he simply waits until a user signs in, checks if they have a legacy insecure password and proceeds to convert their password to the new secure storage offered by Devise.
