DIR Return Create A Forum - Home
---------------------------------------------------------
COC Reboot
HTML https://cocreboot.createaforum.com
---------------------------------------------------------
*****************************************************
DIR Return to: 2020-11-10 Executive Meeting
*****************************************************
#Post#: 77--------------------------------------------------
Password encryption on the web site
DIR By: rhandom
Date: October 24, 2020, 5:12 pm
---------------------------------------------------------
The passwords in the COC database are not encrypted. A few
years ago, Roy and I developed a password encryption "patch"
that was offered to the organizations using my code. The COC
was one organization that declined to purchase that "patch".
The perception was that, since the COC is using SSL, this is not
a high risk issue.
A concern was raised a month ago from a member who noticed that
the "forgot password" feature e-mails the unencrypted password
to a member who has forgotten their password. This is
vulnerable to "exposing" someone's password to a hacker who
knows a member's e-mail address.
We may want to consider a "fix" for this problem. I can think
of three possible scenarios:
1) Keep status-quo for now
2) Keep the passwords stored as plain text, but replace the
current "forgot password" feature with a feature that allows a
user to reset their password rather than e-mailing the plain
text password out
3) Purchase the password encryption "patch" from Roy
Thoughts?
#Post#: 82--------------------------------------------------
Re: Password encryption on the web site
DIR By: Duane
Date: October 25, 2020, 1:25 am
---------------------------------------------------------
I think option 1 would suffice in the short term but certainly
not a bad idea to discuss a fix timeline. Do we have a cost on
option 2 and 3?
#Post#: 84--------------------------------------------------
Re: Password encryption on the web site
DIR By: rhandom
Date: October 25, 2020, 3:30 am
---------------------------------------------------------
Option 2 would be free because I would do it. I already have
the code for it and it would be a relatively simple change.
Option 3 is more involved and not something that I'm able to
take on (either free or paid). We'll have to get costing from
Roy.
#Post#: 108--------------------------------------------------
Re: Password encryption on the web site
DIR By: Duane
Date: October 29, 2020, 11:25 pm
---------------------------------------------------------
Did someone say free? I would like to change my vote to option
2. lol
#Post#: 128--------------------------------------------------
Re: Password encryption on the web site
DIR By: LenK
Date: November 4, 2020, 7:47 am
---------------------------------------------------------
I think this needs to be tabled until Roy provides an estimate
so we have all of the information.
#Post#: 130--------------------------------------------------
Re: Password encryption on the web site
DIR By: rhandom
Date: November 4, 2020, 7:53 am
---------------------------------------------------------
I will try to get that information from him prior to the
meeting. Thank you!
#Post#: 133--------------------------------------------------
Re: Password encryption on the web site
DIR By: rhandom
Date: November 5, 2020, 11:10 am
---------------------------------------------------------
Info from Roy: 5 hours * $80 per hour + GST = $420.
#Post#: 134--------------------------------------------------
Re: Password encryption on the web site
DIR By: Roy Scarisbrick
Date: November 5, 2020, 11:25 am
---------------------------------------------------------
I would say that the current "forgotten password" isn't so bad.
Sure, you could enter anyone's email address but the email is
only going to go to the holder of that email account. Strictly,
it's proper to store passwords as plain text, but that's another
issue.
*****************************************************
Page 1 of 1