Implement password hashing

[wode490390]

See also CloudburstMC/Nemisys#53

[DaMatrix]

• md5 is no longer considered cryptographically secure
• hashing is not encryption
• the hash is now equivalent to being the password, meaning there's no advantage

[wode490390]

@DaMatrix Clear text passwords are a serious security risk. Digest authentication has significant advantages over clear text passwords, though other security issues arise. We can use sha256 instead of md5.

[DaMatrix]

the point is, since the password is a) stored as plain text anyway and b) transmitted insecurely, the hash is effectively the plaintext password

[wode490390]

Ah, we can use salt:
md5(md5(password) + salt)

[DaMatrix]

a salt doesn't make any difference! if you're using the hash for authentication, the hash is the password. this is literally exactly as secure as it was before.

[DaMatrix]

if you want a secure authentication system, you'd need something like HMAC with SHA-256 or SHA-3