Epic: Security Hardening — Upgrade Password Hashing #151

New issue

Open

opened 2026-03-15 23:08:31 +00:00 by freemo · 0 comments

freemo commented

2026-03-15 23:08:31 +00:00

Owner

Background and Context

Player passwords are currently stored as MD5 hex digests (Digest::MD5.new.update(password).to_s) in both the GDBM passwords store and the ES PlayerCreated/UpdatePlayerPassword events. MD5 is cryptographically broken — rainbow tables and collision attacks make it trivial to reverse hashes. This Epic upgrades password storage to bcrypt with transparent migration of existing MD5 hashes.

Demonstrable Outcome

New passwords are stored as bcrypt hashes. Existing MD5 passwords are transparently upgraded to bcrypt on successful login. No player is locked out during the transition.

Acceptance Criteria

All new password storage uses bcrypt
Existing MD5 hashes are detected and upgraded on login
Digest::MD5 is no longer used for password hashing
bcrypt gem is in runtime dependencies
Both GDBM and ES password paths use bcrypt

## Background and Context Player passwords are currently stored as MD5 hex digests (`Digest::MD5.new.update(password).to_s`) in both the GDBM `passwords` store and the ES `PlayerCreated`/`UpdatePlayerPassword` events. MD5 is cryptographically broken — rainbow tables and collision attacks make it trivial to reverse hashes. This Epic upgrades password storage to bcrypt with transparent migration of existing MD5 hashes. ## Demonstrable Outcome New passwords are stored as bcrypt hashes. Existing MD5 passwords are transparently upgraded to bcrypt on successful login. No player is locked out during the transition. ## Acceptance Criteria - All new password storage uses bcrypt - Existing MD5 hashes are detected and upgraded on login - `Digest::MD5` is no longer used for password hashing - `bcrypt` gem is in runtime dependencies - Both GDBM and ES password paths use bcrypt