3 ms·
Do you realize that the phpass framework you recommend uses $2a$, even though you say not to use that?
by blackhole 14y ago
Do you realize that the phpass framework you recommend uses $2a$, even though you say not to use that?
- junto 14y agoJust to be clear, I didn't write the article, and I didn't recommend anything. If anything, it was posted as a discussion piece.
- blackhole 14y agoWell then the article is saying don't use $2a$ and then saying "oh but use this framework which also uses $2a$", which is terribly inconsistent. It should discuss when and where $2a$ could potentially be a problem.
- junto 14y agoFull steam ahead on the critique. I wanted to point out that you had no need to start bashing me about it!
- courtewing 14y agoFor the record, it is trivial to change PHPass to use $2y$ instead of $2a$. That said, this does require extending the PHPass class, so it is not ideal. Still, it would be better to extend or modify the class than it would be to simply try to roll your own (if those were your only two options).
- tedunangst 14y agoWhy would anyone recommend using bcrypt and then say to not use bcrypt ($2a$)?
- blackhole 14y agoBecause you are technically supposed to use $2y$ which ensures you are not using the broken implementation that was fixed in 2011. Of course if you are using a newer php installation $2a$ will be identical to $2y$ so it's just a disambiguation, just as $2x$ is used to identify hashes generated using the broken implementation.