[feat] Use Argon2 password hashes #403

New issue

Closed

opened 2022-12-28 18:33:41 +00:00 by norm · 2 comments

norm commented

2022-12-28 18:33:41 +00:00

Contributor

The idea

Akkoma should use a more modern password hashing algorithm like Argon2 to make passwords harder to crack in the event of a database leak.

There is an Elixir implementation of Argon2: https://hex.pm/packages/argon2_elixir.

The reasoning

Akkoma currently uses PBKDF2 as its password hashing algorithm. However, it relatively easy to brute force with GPUs and ASICs compared to more modern hashing algoirthms.

Have you searched for this feature request?

I have double-checked and have not found this feature request mentioned anywhere.
This feature is related to the Akkoma backend specifically, and not pleroma-fe.

### The idea Akkoma should use a more modern password hashing algorithm like [Argon2](https://en.wikipedia.org/wiki/Argon2) to make passwords harder to crack in the event of a database leak. There is an Elixir implementation of Argon2: https://hex.pm/packages/argon2_elixir. ### The reasoning Akkoma currently uses PBKDF2 as its password hashing algorithm. However, it relatively easy to brute force with GPUs and ASICs compared to more modern hashing algoirthms. ### Have you searched for this feature request? - [x] I have double-checked and have not found this feature request mentioned anywhere. - [x] This feature is related to the Akkoma backend specifically, and not pleroma-fe.

norm added the

feature request

label 2022-12-28 18:33:41 +00:00

floatingghost commented

2022-12-29 17:43:16 +00:00

Owner

yes 100% i want to do this

did you know there's backwards compat for passwords like 3 hashing schemes back? (https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/plugs/authentication_plug.ex#L41)

there shouldn't be :aaaa:

yes 100% i want to do this did you know there's backwards compat for passwords like 3 hashing schemes back? (https://akkoma.dev/AkkomaGang/akkoma/src/branch/develop/lib/pleroma/web/plugs/authentication_plug.ex#L41) there shouldn't be :aaaa: