Passwords are stored in an insecure un-salted form

[jammin84]

password stored in the db is a straight md5 unsalted.
as seen in
globals/classes/userdata.php:83
$this->check_login($username, md5($password))

At a minimum I would expect:

• some kind of salt be used.
  • The salt could be generated at time of install.
• Dont use md5 (its easily crackable)
• Use an open platform.
  • such as http://www.openwall.com/phpass/

other suggestions welcome

[spinza]

Sounds good. We are probably moving our sign-in to be based on our forum. I.e. not using wind login at all. Enables tighter integration. Will post an issue for that soon.

[MDE186]

Hashing Passwords with the PHP 5.5 Password Hashing API

https://www.sitepoint.com/hashing-passwords-php-5-5-password-hashing-api/
https://github.com/Antnee/phpPasswordHashingLib
https://github.com/ircmaxell/password_compat - PHP 5.3.7 (or later)