How to make Passwords more secure in Magento Community Edition? - security

Question

How can I make magento to store passwords with better encryption.Since md5 is not robust one.
Is there an way to increase security in magento?
So the customer details are secure.

Answer 1

You can change the magento encryption algorithm from your custom one. I'm using SHA1 for my mageto. i have created a custom module for that.Inside the hash function you can implement your any of algorithm.
magento/app/code/local/My/ShaModule/Model/Encryption.php
public function getHash($password, $salt = false)
{
return $this->hash($password);
}
public function hash($data){
return sha1($data);
}
public function validateHash($password, $hash) {
return $this->hash($password) === $hash;
}
}
?>
magento/app/code/local/My/ShaModule/etc/config.xml
<?xml version="1.0" encoding="UTF-8"?>
<!--
Document : config.xml
Created on : July 26, 2012, 1:12 PM
Author : sanjeewani
Description:
Purpose of the document follows.
-->
<config>
<modules>
<My_ShaModule>
<version>0.1.0</version>
<depends>
<Mage_Core />
</depends>
</My_ShaModule>
</modules>
<global>
<models>
<core>
<rewrite>
<encryption>My_ShaModule_Model_Encryption</encryption>
</rewrite>
</core>
</models>
<helpers>
<core>
<encryption_model>My_ShaModule_Model_Encryption</encryption_model>
</core>
</helpers>
</global>
<frontend>
<routers>
<my_shamodule>
<use>standard</use>
<args>
<module>My_ShaModule</module>
<frontName>shamodule</frontName>
</args>
</my_shamodule>
</routers>
</frontend>
</config>

Answer 2

You can refer to a good blog on this:
http://www.magentogarden.com/blog/how-are-passwords-encrypted-in-magento.html
It uses the same MD5, but has a slat of additional security attached to it.