Password Field values are saved as plaintext by default?

[rclai]

Shouldn't they be hashed at least?

Perhaps have an option in the field definition to choose what kind of encryption to use?

[sc0ttkclark]

The only difference between password fields and normal text fields is the use of the password input field itself.

In the future, we can add options for encryption/hashing of the value during save.

[rclai]

Cool.

[orchid-hybrid]

Hello,

I've written up an initial commit for password hashing: #2229

This adds two options to password fields: whether or not you'd like to hash them, and what salt to use. It stores them as 32 byte (256 bit) values using pbkdf2 sha1.

I hope this is useful to you as I think password hashing is very important! Looking forward to review.

[sc0ttkclark]

Replied on #2229, looks great!

[pglewis]

Going to bump this back to Future Release, for now. Loop fields or bust for 3.0.

[lougreenwood]

Any news on this? I just noticed that password fields are stored as plain text.

Also, one thing I'd like to suggest is that when this is released, all existing passwords fields are automatically changed to be saved as hash, so there's no need to manually update existing posts that were previously saved as plaintext...