{"action":"created","issue":{"url":"https://api.github.com/repos/johnathanmartin/piWallet/issues/36","repository_url":"https://api.github.com/repos/johnathanmartin/piWallet","labels_url":"https://api.github.com/repos/johnathanmartin/piWallet/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/johnathanmartin/piWallet/issues/36/comments","events_url":"https://api.github.com/repos/johnathanmartin/piWallet/issues/36/events","html_url":"https://github.com/johnathanmartin/piWallet/issues/36","id":285069979,"node_id":"MDU6SXNzdWUyODUwNjk5Nzk=","number":36,"title":"Insecure hashing algorithm","user":{"login":"nmalcolm","id":973100,"node_id":"MDQ6VXNlcjk3MzEwMA==","avatar_url":"https://avatars3.githubusercontent.com/u/973100?v=4","gravatar_id":"","url":"https://api.github.com/users/nmalcolm","html_url":"https://github.com/nmalcolm","followers_url":"https://api.github.com/users/nmalcolm/followers","following_url":"https://api.github.com/users/nmalcolm/following{/other_user}","gists_url":"https://api.github.com/users/nmalcolm/gists{/gist_id}","starred_url":"https://api.github.com/users/nmalcolm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nmalcolm/subscriptions","organizations_url":"https://api.github.com/users/nmalcolm/orgs","repos_url":"https://api.github.com/users/nmalcolm/repos","events_url":"https://api.github.com/users/nmalcolm/events{/privacy}","received_events_url":"https://api.github.com/users/nmalcolm/received_events","type":"User","site_admin":false},"labels":[{"id":162303291,"node_id":"MDU6TGFiZWwxNjIzMDMyOTE=","url":"https://api.github.com/repos/johnathanmartin/piWallet/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2017-12-29T10:28:44Z","updated_at":"2018-07-30T20:40:59Z","closed_at":null,"author_association":"NONE","body":"Hi,\r\n\r\npiWallet uses an insecure hashing algorithm to store user passwords, plain MD5. It's weakened by the fact `strip_tags()` is being run on the plaintext password (why?). \r\n\r\n```\r\n$password = md5(addslashes(strip_tags($password)));\r\n```\r\nPlease consider switching to bcrypt.\r\n\r\nhttps://paragonie.com/blog/2016/02/how-safely-store-password-in-2016"},"comment":{"url":"https://api.github.com/repos/johnathanmartin/piWallet/issues/comments/409002753","html_url":"https://github.com/johnathanmartin/piWallet/issues/36#issuecomment-409002753","issue_url":"https://api.github.com/repos/johnathanmartin/piWallet/issues/36","id":409002753,"node_id":"MDEyOklzc3VlQ29tbWVudDQwOTAwMjc1Mw==","user":{"login":"DominoTree","id":5438118,"node_id":"MDQ6VXNlcjU0MzgxMTg=","avatar_url":"https://avatars3.githubusercontent.com/u/5438118?v=4","gravatar_id":"","url":"https://api.github.com/users/DominoTree","html_url":"https://github.com/DominoTree","followers_url":"https://api.github.com/users/DominoTree/followers","following_url":"https://api.github.com/users/DominoTree/following{/other_user}","gists_url":"https://api.github.com/users/DominoTree/gists{/gist_id}","starred_url":"https://api.github.com/users/DominoTree/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DominoTree/subscriptions","organizations_url":"https://api.github.com/users/DominoTree/orgs","repos_url":"https://api.github.com/users/DominoTree/repos","events_url":"https://api.github.com/users/DominoTree/events{/privacy}","received_events_url":"https://api.github.com/users/DominoTree/received_events","type":"User","site_admin":false},"created_at":"2018-07-30T20:40:59Z","updated_at":"2018-07-30T20:40:59Z","author_association":"NONE","body":"Combine #77 with this issue and you've got an easy day with HashCat to obtain plaintext passwords."}}
{"actor":{"display_login":"DominoTree"}}