3 ms·

Funny story - quite a few years back I was a sysadmin for a company that was compiling their own PHP with a couple of patches. When I asked about it, my co-wor

Funny story - quite a few years back I was a sysadmin for a company that was compiling their own PHP with a couple of patches. When I asked about it, my co-worker said it was to suppress some warnings that were spamming the logs whenever someone created an account. Yes, those warnings were telling us that we weren't using an initialization vector (IV, aka a salt) when hashing the passwords. Facepalm. I suppose that demonstrates the dangers of developers thinking they should be diving into level 3), and also the benefit of (my) being aware of more of the theory than we should have been implementing ourselves. Yes, I filed a bug to start using hashes, re-hash all our users' passwords, and get rid of the patch. This was also well before those massive GPU cracking systems, so everything turned out fine.

jiggy2011 13y ago
Once you are choosing salts that is almost level 4 knowledge. This is one of the problems with "raw" PHP development, there's no way to say "this is a password field, make it secure" only "hash this with algorithm X". To be fair though , I believe recent releases have addressed this and frameworks like symphony give you a default user class to inherit from that does things sensibly. It also sticks a seed for the salt directly in the config file (where devs will see it) and says "make sure you set this randomly and keep it secret".
- carbocation 13y ago
  Hmm, unfortunately I think Symfony2 runs passwords through 1 round of SHA1 unless a custom password "encoder" is used [1]. [1] = http://symfony.com/doc/2.0/book/security.html#encoding-the-user-s-password http://symfony.com/doc/2.0/book/security.html#encoding-the-u...
  - terolacu 13y ago
    Bcrypt and PBKDF2 are not custom, they are part of the framework: http://symfony.com/doc/current/reference/configuration/security.html#reference-security-pbkdf2 http://symfony.com/doc/current/reference/configuration/secur...
    - carbocation 13y ago
      Those were added in Symfony2.2; my last experience was with 2.1. Also, I understand that neither of those is default; one should be.
- terolacu 13y ago
  > This is one of the problems with "raw" PHP development ... or any other language.

jiggy2011 13y ago

Once you are choosing salts that is almost level 4 knowledge. This is one of the problems with "raw" PHP development, there's no way to say "this is a password field, make it secure" only "hash this with algorithm X". To be fair though , I believe recent releases have addressed this and frameworks like symphony give you a default user class to inherit from that does things sensibly. It also sticks a seed for the salt directly in the config file (where devs will see it) and says "make sure you set this randomly and keep it secret".

carbocation 13y ago
Hmm, unfortunately I think Symfony2 runs passwords through 1 round of SHA1 unless a custom password "encoder" is used [1]. [1] = http://symfony.com/doc/2.0/book/security.html#encoding-the-user-s-password http://symfony.com/doc/2.0/book/security.html#encoding-the-u...
- terolacu 13y ago
  Bcrypt and PBKDF2 are not custom, they are part of the framework: http://symfony.com/doc/current/reference/configuration/security.html#reference-security-pbkdf2 http://symfony.com/doc/current/reference/configuration/secur...
  - carbocation 13y ago
    Those were added in Symfony2.2; my last experience was with 2.1. Also, I understand that neither of those is default; one should be.
terolacu 13y ago
> This is one of the problems with "raw" PHP development ... or any other language.