Quote: "It took only 24 hours using an old spare machine to crack 25% of the passwords. Very little effort or CPU power." Time for another "use bcrypt", methinks.
Couchdb has an open ticket on this very issue, which is part of the problem. The other part is the fact that they have really nonsensical configuration defaults.
It looks like "security in deployment" (aka sane defaults) is a concept difficult to grasp for the CouchDB devs. I wouldn't expect this from a project that claims it is passed over version 0.x.
3 comments
[ 0.18 ms ] story [ 15.2 ms ] threadhttps://issues.apache.org/jira/browse/COUCHDB-1060