Safe password storage

Since XWiki uses a simple/single view on all the data, password fields cannot be treated in a special way, so they cannot be excluded from search queries, scripted data access, or search engine indexing. Thus, the passwords should be stored in such a manner that the stored value cannot be used in any way, like the values from /etc/shadow cannot be used.

So, this meas that password fields should be stored as:

• plain text (no security)
• hash (safe, but cannot be reversed) with an optional salt
• encrypted (safe, as long as the encryption key is safe) with an optional salt