| Summary: | Password sent by message (accdetails) without decryption | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Pablo Jones <pablo.joneslobos> |
| Component: | Tools | Assignee: | Bugs List <koha-bugs> |
| Status: | CLOSED INVALID | QA Contact: | Testopia <testopia> |
| Severity: | normal | ||
| Priority: | P5 - low | CC: | dcook |
| Version: | 21.11 | ||
| Hardware: | Other | ||
| OS: | Linux | ||
| GIT URL: | Initiative type: | --- | |
| Sponsorship status: | --- | Comma delimited list of Sponsors: | |
| Crowdfunding goal: | 0 | Crowdfunding committed: | 0 |
| Crowdfunding contact: | Patch complexity: | --- | |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
|
Description
Pablo Jones
2023-03-28 18:09:58 UTC
Blowfish isn't an encryption algorithm; it's a hashing algorithm. It computes data only in one direction. You can't reverse the password hash without trying to hack/crack it. So the problem here isn't "the password is sent without being [decrypted]". The problem is that the password hash is being sent instead of the cleartext password. However, you shouldn't be sending out cleartext passwords by email. That's why in Koha 21.11.05, due to bug 27812, you can no longer send out cleartext passwords using ACCTDETAILS. |