Changes between Initial Version and Version 1 of Ticket #34661


Ignore:
Timestamp:
Jun 16, 2023, 12:15:21 PM (18 months ago)
Author:
Fatih Erikli
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #34661 – Description

    initial v1  
    2626There is one more element needed for hashing the password, **pepper**, should be django project specific. Even when a database is exposed, the attacker will not be able to lookup the known passwords, since they don't have the secret pepper key.
    2727
    28 Is this a known issue?
     28This causes CWE-760: Use of a One-Way Hash with a Predictable Salt [https://cwe.mitre.org/data/definitions/760.html].
Back to Top