3

After reading the post about linkedin on IT security and this issue I would think that having a default Drupal 6 installation without, for example, the phpass module should be considered quite insecure, since the passwords are stored in a way which doesn't require much force to guess and check.

Should I run and install phpass on every Drupal 6 site?

5

Yes!

You should consider Drupal 6 without phpass to be unnecessarily insecure. And yes, you should use phpass on all your D6 apps. There are reasons they've changed the way things work in Drupal 7, and made the same changes available as a module to D6 users.

There is no silver bullet, but there's no reason to ignore an easy-to-use module that will significantly increase your level of security.

Not using it is a little like not wearing a seat belt: of course you want to avoid ever being in an accident to begin with (analogous to ever letting anyone gain access to your data), but once you have an accident it's far too late to try buckling up. Buckle up now!

Update: A security expert seems to agree with me:

...take the view that attackers will ultimately get into your network, access your data... you should be looking at the problem differently.

  • 1
    The analogy makes sense to me and it's worth noting that much of the world is happy to drive in cars without seatbelts ;) I definitely would encourage anyone using Drupal 6 to install PHPass module and specifically the 6.x-2.x branch. – greggles Jun 13 '12 at 15:14
  • 276,294 copies of D6 in the wild and only 809 installs of phpass. If the problem is so dire why the huge discrepancy? – Mark Ferree Jun 13 '12 at 18:23
  • 1
    @MarkFerree: "so dire" is your phrase, not mine. And what conclusion are you drawing from those numbers? – iconoclast Jun 21 '12 at 16:29
  • Hard to draw a conclusion. Either the vast majority of Drupal 6 site owners don't see this as an issue, or more likely aren't aware of the problem at all. – Mark Ferree Jun 21 '12 at 18:02
2

Security happens at many different points in the system. As far as I'm concerned if a hacker already has full database access it is game over.

To help protect your user's privacy I would do everything you can at the server level to prevent that from happening.

Another step you can take is sanitizing the user data you don't need when moving around development databases. If you are not using the password hashes in development leave them on the production server where they are secure and less likely to be misplaced.

That being said adding phpass definitely doesn't hurt. My philosophy on security is to cover as meany weaknesses as possible without driving yourself crazy chasing edge cases and it seems easy enough to add to the mix.

  • Probably security is not an exact term here (nor is privacy) and i am sorry i cant think of a better one. Your remark about "game over" has been adressed i think in the linked issue. Basically - you dont know someone has your database (or a part thereof) and they can read passwords of your users who trusted you. I suppose poeple @ linkedin are now bumping their heads into every accessible wall, murmuring "why didnt we ...". – mojzis Jun 12 '12 at 23:20
  • Where I was trying to go here is not wasting too much energy worrying about a hashing algorithm when there are other steps to take to avoid getting yourself into trouble. Having an attacker grab your database is still a serious problem even if they don't crack your user's passwords. – Mark Ferree Jun 13 '12 at 18:20
  • 1
    Yep, i get your point, but as @Brandon says above : someone will allways break in, if they really want. And then you have a trouble, but in case you didnt secure the passwords, even the customers / visitors / members have a trouble - because many of them just use the same password everywhere... We are talking about this extra trouble that can be easily avoided. – mojzis Jun 13 '12 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.