mirror of
https://github.com/unrealircd/unrealircd.git
synced 2026-07-02 05:06:38 +02:00
Bram Matthys
7dcb5a5bb1
deprecated because they can be cracked at high speeds. They still work, but a warning will be shown on boot and on rehash. Please use 'bcrypt' or (even better) the new 'argon2' type instead: "./unrealircd mkpasswd argon2" or "/mkpasswd argon2 passwd" on IRC. Also, not in release notes because it would take up too much text: Unix crypt is a bit more complicated: most types are outright 'bad', while other types have reasonable security similar to 'bcrypt'. To be honest these people should probably use 'argon2' since it's a lot better. Then again, warning about this when it's still such a common hashing method (now, in 2018) may be a bit overzealous. So: not warning about crypt types $5/$6 which use SHA256/SHA512 with normally at least 5000 rounds (unless deliberately weakened by the user), but we do warn about other crypt() usage. Also, mkpasswd support for those deprecated types has been removed since there's no good reason to generate new password hashes with these.