Usage of weak encryption algorithm on a password (RC4)
Last updated
Last updated
Rule ID: javascript_lang_weak_password_encryption_rc4
Applicable Languages: Javascript
Weakness ID: CWE-326
Using RC4 to encrypt passwords is insecure. RC4 is a weak encryption algorithm that can be easily compromised, posing significant security risks. Additionally, employing any form of encryption for passwords is not recommended because encryption is reversible. This means that, with sufficient resources, an attacker could decrypt the passwords and access them in plain text. Hashing is the preferred method for securing passwords, as it is a one-way process that prevents retrieval of the original password.
Avoid using RC4 or any encryption algorithm for password storage. Encryption methods are insufficiently secure for protecting passwords and can be reversed to reveal plain text passwords.
Use a secure hashing algorithm designed specifically for password storage, such as Argon2id. Hashing is a one-way process, providing significantly better security for storing passwords.
To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our