3 ms·
password_verify was erroneously returning true for include hashes. In the most common case where the user gives you a password and you immediately hash it and c
by jefftk 4y ago
password_verify was erroneously returning true for include hashes. In the most common case where the user gives you a password and you immediately hash it and call password_verify this doesn't come up, but any case where an attacker can influence the hash is at risk (ex: hashing on the client).
The first comment on the bug report is pretty depressing.
- bawolff 4y agoI don't understand the scenario. You're saying this is bad if you hash on client side and compare to a plaintext password stored on the server? I mean, i suppose, but such a setup is so broken does it matter?
- jefftk 4y agoI agree that this is broken, and loses much of the benefit of hashing. But this is the php ecosystem; I'd be surprised if no one was doing that!