4 ms·
So you are supposed to md5 the results of the password_hash() function before storing them in a database right?
by nthitz 14y ago
So you are supposed to md5 the results of the password_hash() function before storing them in a database right?
- martin-adams 14y agoOf course! It totally adds another layer of protection :)
- deleted 14y ago[deleted]
- mikle 14y agoDon't forget double rot13.
- 16s 14y agoFor those who may not get this joke: # One rot13 $ echo test | wm --rot13 --words stdin grfg # Double rot13 $ echo test | wm --rot13 --words stdin | wm --rot13 --words stdin test
- 1SaltwaterC 14y agoIt's actually called ROT26: "An encryption scheme similar to ROT13, but twice as secure."
- mparlane 14y agoIf this was NOT a joke... No, do not md5 as you will lose hash type info. edit: To be clear I am assuming it IS a joke. I hope.. oh god I hope.
- Dylan16807 14y agoWhy would you even worry about it not being a joke? Even if by some quirk of fate they were serious, the code would immediately fail and put no data at risk.
- mparlane 14y agoMy hopes weren't with the code, but with the fact that it is explained in the article.
- anonymous 14y agoNo, this is totally insecure. You're supposed to generate a public/private key pair for the user, encrypt the hash with the public key and store the private key in a separate database on a separate server that isn't connected to the internet and doesn't allow remote log-in from the lan.