4 ms·
I'm actually quite surprised at the initial response by the PHP Core to this vulnerability. At very least I would have thought a sensible approach would be to f
by mikehall314 4y ago
I'm actually quite surprised at the initial response by the PHP Core to this vulnerability. At very least I would have thought a sensible approach would be to fail securely - so if supplied with a bad hash you return false, not true!
- jefftk 4y agoIt looks to me like it's trying to return false on a bad hash but missed one of the three ways crypt can signal failure (returning the input unmodified).
- TimWolla 4y ago> but missed one of the three ways crypt can signal failure (returning the input unmodified) Returning the input unmodified is not failure, but success. That's how you check that a password is valid without having a specialized API.
- jefftk 4y agoEDIT: I misread the linked post, ignore me! <strike>crypt is the hashing function, not the password checking function</strike>
- TimWolla 4y agoI assume s/bit/not/. The checking function is “does the given password with the stored parameters hash to the same value as the stored hash”. Hash functions are deterministic. So returning the original hash for a valid password is the success case.