[eluser]xwero[/eluser]
[quote author="fdog" date="1203160627"]Instead of using $config['encryption_key'] for the encryption salt, just randomly generate a new salt for each new password. But be sure of also inserting the salt in the database
[/quote]
Storing the salt in the database is less safe than putting it into a php file because a clever hacker will see the connection.
I agree with Elliot decodable passwords can be a security risk but if they can see the passwords they can also see the data they are really after. The only thing they can't crack is the password which isn't always the main target for a hacker.
If you are paranoid you will encrypt all hacker valuable data but it will reduce performance.
