Post password stored as plaintext

[ericmann]

When a user specifies a password for a protected post it's stored as plaintext in the database. Considering the rate at which people recycle personal passwords, does this open a user's site to potential security risks?

While not necessarily our responsibility, this would raise issues if they use the same password for a login and for their protected posts.

[scribu]

I see no harm in doing at least a simple md5() on the password. (It shouldn't be the same hashing function used for user passwords)

[filosofo]

As suggested for private posts in #11695, it might be nice to move password stuff into a "canonical" plugin. Currently it's pretty hacky.

[filosofo]

Or better, I should link to #11697

[nacin]

Perhaps we can block post passwords if when hashed it is the same as their user password...

[ericmann]

Replying to nacin:

Perhaps we can block post passwords if when hashed it is the same as their user password...

That would be an excellent short-term solution that would increase security (protect users from themselves, really). But I'm still somewhat uncomfortable storing anything that resembles a password in plaintext.

[nacin]

It's something that is designed to be shared, so storing it hashed is pretty much a no-go. People will need to refer to it, change it, etc. There is a reason why we store it in a type=text field, rather than type=password. That alone should probably scare most people away from entering a full password.

Perhaps calling it something other than a "password" would also help, but that ship has sailed.

[ericmann]

Replying to nacin:

It's something that is designed to be shared, so storing it hashed is pretty much a no-go.

Good point.

Perhaps calling it something other than a "password" would also help, but that ship has sailed.

Perhaps we could rename it in a future release? It won't be the first time we've renamed a feature. (Admin bar => toolbar)

[ericlewis]

Replying to ericmann:

Perhaps we could rename it in a future release? It won't be the first time we've renamed a feature. (Admin bar => toolbar)

I don't see too much benefit here. At the end of the day, it is a password. Calling it by any other name wouldn't be as descriptive.

I suggest we wontfix this.

[ericmann]

Replying to ericlewis:

Calling it by any other name wouldn't be as descriptive.

I suggest we wontfix this.

It's been a while since I considered this an issue, so I'm given to agreeing with you. Closing as wontfix unless someone else wants to make a compelling argument.