4 ms·
> fixing the password security would've required breaking everyone's ability to commit to the PHP codebase Can’t you have a scheme that is like bcrypt(md5(pass
by taspeotis 6y ago
> fixing the password security would've required breaking everyone's ability to commit to the PHP codebase
Can’t you have a scheme that is like bcrypt(md5(password)) and since you already have md5(password) in the database you can migrate to bcrypt?
- drrotmos 6y agoNot if you need to support HTTP Digest authentication.
- merb 6y agowell http digest auth is stupid. it looks more secure because the password is not sent unencrypted over the wire. however it still is bad. kerberos or even basic auth (because the password can be checked on the server against a real algorithm) would've made this impossible.