The website I am working on just failed a security audit because the passwords in
enterprise_admin_passwords do not have salts.
I tried looking at the
Enterprise_Pci module (where the table is declared) - and found that the table is used to save old passwords, possibly for the purpose of forcing the admin user to change them when they expire.
- What is that table used for ?
- Are the passwords there used without salts, or are they taken from the