Make Default Password Alg. settable on the install page #6862

New Issue

GiteaMirror · 2025-11-02T07:09:09-06:00

GiteaMirror commented

2025-11-02 07:09:09 -06:00

Originally created by @6543 on GitHub (Feb 13, 2021).

... we just move back to pbkdf2 but make it settable on the install page with warnings about the issues.

Originally posted by @zeripath in https://github.com/go-gitea/gitea/issues/14294#issuecomment-777842803

Originally created by @6543 on GitHub (Feb 13, 2021). ... we just move back to pbkdf2 but make it settable on the install page with warnings about the issues. _Originally posted by @zeripath in https://github.com/go-gitea/gitea/issues/14294#issuecomment-777842803_

GiteaMirror added the type/proposal label 2025-11-02 07:09:09 -06:00

GiteaMirror closed this issue

2025-11-02 07:09:09 -06:00

GiteaMirror commented

2025-11-02 07:09:10 -06:00

@CirnoT commented on GitHub (Feb 13, 2021):

we just move back to pbkdf2

Please think very carefully about this - this is a clear downgrade in term of security that everyone upgrading will need to address themselves and adjust config accordingly if they don't wish to accept it. Make sure that if you proceed with reverting default algo to pbkdf2, it is clearly communicated in release notes along with example given to users on how to avoid this change happening.

but make it settable on the install page with warnings about the issues.

Nothing against this

@CirnoT commented on GitHub (Feb 13, 2021): >we just move back to pbkdf2 Please think very carefully about this - this is a clear downgrade in term of security that everyone upgrading will need to address themselves and adjust config accordingly if they don't wish to accept it. Make sure that if you proceed with reverting default algo to pbkdf2, it is clearly communicated in release notes along with example given to users on how to avoid this change happening. >but make it settable on the install page with warnings about the issues. Nothing against this

GiteaMirror commented

2025-11-02 07:09:10 -06:00

@zeripath commented on GitHub (Feb 13, 2021):

There's a balance here.

Argon2 is clearly causing multiple problems.

I cannot recommend argon2 in good conscience at present.

I agree we need to make this very clear on the blog post releasing the version as it clearly is extreme

@zeripath commented on GitHub (Feb 13, 2021): There's a balance here. Argon2 is clearly causing multiple problems. I cannot recommend argon2 in good conscience at present. I agree we need to make this very clear on the blog post releasing the version as it clearly is extreme

GiteaMirror commented

2025-11-02 07:09:11 -06:00

@lunny commented on GitHub (Feb 15, 2021):

We should notice that on our release notes of v1.13.3 and v1.14.0 .
And we also need an option on install page where we can detect the server's total memory to recommend one algorithm. For memory > 2GB we can recommend argon2 and otherwise pbkdf2 and user still change it to scrypt and others.

And this is only default algorithm, users could still change them on configuration file.

@lunny commented on GitHub (Feb 15, 2021): We should notice that on our release notes of v1.13.3 and v1.14.0 . And we also need an option on install page where we can detect the server's total memory to recommend one algorithm. For memory > 2GB we can recommend argon2 and otherwise pbkdf2 and user still change it to scrypt and others. And this is only default algorithm, users could still change them on configuration file.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6862