3 ms·
Once you are choosing salts that is almost level 4 knowledge. This is one of the problems with "raw" PHP development, there's no way to say "this is a password
by jiggy2011 13y ago
Once you are choosing salts that is almost level 4 knowledge. This is one of the problems with "raw" PHP development, there's no way to say "this is a password field, make it secure" only "hash this with algorithm X".
To be fair though , I believe recent releases have addressed this and frameworks like symphony give you a default user class to inherit from that does things sensibly. It also sticks a seed for the salt directly in the config file (where devs will see it) and says "make sure you set this randomly and keep it secret".
- carbocation 13y agoHmm, unfortunately I think Symfony2 runs passwords through 1 round of SHA1 unless a custom password "encoder" is used [1]. [1] = http://symfony.com/doc/2.0/book/security.html#encoding-the-user-s-password http://symfony.com/doc/2.0/book/security.html#encoding-the-u...
- terolacu 13y agoBcrypt and PBKDF2 are not custom, they are part of the framework: http://symfony.com/doc/current/reference/configuration/security.html#reference-security-pbkdf2 http://symfony.com/doc/current/reference/configuration/secur...
- carbocation 13y agoThose were added in Symfony2.2; my last experience was with 2.1. Also, I understand that neither of those is default; one should be.
- terolacu 13y ago> This is one of the problems with "raw" PHP development ... or any other language.