4 ms·

> your password will be encrypted using a modern secure algorithm, which is currently PHP’s password_hash function, which uses Blowfish or Extended DES and can

by akerl_ 8y ago

> your password will be encrypted using a modern secure algorithm, which is currently PHP’s password_hash function, which uses Blowfish or Extended DES and can change over time so we don’t repeat any past mistakes. Not sure if the OSNews folks are reading this, but I'd definitely not consider either Blowfish or DES to be secure password storage methods. Surely there's some library that'll do bcrypt/scrypt/etc in PHP? Also, it seems pretty bold to push users with a call-to-action around volunteering / sponsoring in the same post as they alert users to a breach.

ronsor 8y ago
bcrypt uses the Blowfish cipher. http://php.net/manual/en/function.password-hash.php http://php.net/manual/en/function.password-hash.php: PASSWORD_BCRYPT - Use the CRYPT_BLOWFISH algorithm to create the hash. This will produce a standard crypt() compatible hash using the "$2y$" identifier. The result will always be a 60 character string, or FALSE on failure.
mattzito 8y ago
> Also, it seems pretty bold to push users with a call-to-action around volunteering / sponsoring in the same post as they alert users to a breach. I understand your point, but I think tone and context matters - they're owning up to the fact that like, "Look, we screwed up, we didn't do a good job here, and hey, we realized that we don't have the resources to do a good job at the moment, so we want to fix that". It would be different/inappropriate coming from a purely commercial service, but a site that uses a lot of volunteeer/community effort should be able to acknowledge mistakes while asking for help.
deleted 8y ago
[deleted]
zelon88 8y ago
> Also, it seems pretty bold to push users with a call-to-action around volunteering / sponsoring in the same post as they alert users to a breach. I think that if OSNews were a company selling products you would be correct. However, the "product" at OSNews kinda IS the community.

by akerl_ 8y ago

ronsor 8y ago

bcrypt uses the Blowfish cipher. http://php.net/manual/en/function.password-hash.php http://php.net/manual/en/function.password-hash.php: PASSWORD_BCRYPT - Use the CRYPT_BLOWFISH algorithm to create the hash. This will produce a standard crypt() compatible hash using the "$2y$" identifier. The result will always be a 60 character string, or FALSE on failure.

mattzito 8y ago

> Also, it seems pretty bold to push users with a call-to-action around volunteering / sponsoring in the same post as they alert users to a breach. I understand your point, but I think tone and context matters - they're owning up to the fact that like, "Look, we screwed up, we didn't do a good job here, and hey, we realized that we don't have the resources to do a good job at the moment, so we want to fix that". It would be different/inappropriate coming from a purely commercial service, but a site that uses a lot of volunteeer/community effort should be able to acknowledge mistakes while asking for help.

deleted 8y ago

[deleted]

zelon88 8y ago

> Also, it seems pretty bold to push users with a call-to-action around volunteering / sponsoring in the same post as they alert users to a breach. I think that if OSNews were a company selling products you would be correct. However, the "product" at OSNews kinda IS the community.