"Salting" passwords before encryption

[Joey3000]

The missing but crucial feature is "salting" passwords before encryption. The salt does not need to be secret, it only needs to have a defined limited validity time, and to be known to both, the client and the server. So that the login page "nonce" can be used in LoginEncrypted.

P.S.: The reason for the need to salt is that, as of now, encrypted passwords can be used in replay attacks. Similarly to a pass-the-hash attack, but passing the encrypted password.

For the UsersManagerEncrypted plugin, see Joey3000/piwik-UsersManagerEncrypted#2.