4 ms·
> There do exist experienced PHP devs who would do password storage the right way but PHP up until now neither made it easy nor encourage these practices as the
by maratd 13y ago
> There do exist experienced PHP devs who would do password storage the right way but PHP up until now neither made it easy nor encourage these practices as they relate to passwords.
As much as I welcome these features, I don't think that's true. PHP has made it extremely easy to use the core operating system's hashing features.
http://us3.php.net/manual/en/function.crypt.php http://us3.php.net/manual/en/function.crypt.php
And after 5.3, even if for whatever reason your operating system is lacking, they were built in for convenience.
- nikic 13y agocrypt() is not extremely easy to use. Actually, it's fairly hard and easy to get wrong. The two things that people usually get wrong is a) salt generation and b) fixed-time comparison.
- LeafStorm 13y agoExcept generating a random salt and the proper hash format to provide as input to crypt() is surprisingly difficult, especially in a cross-platform way. I recently replaced my custom crypt wrapper with the userland implementation of these functions, and in the process I discovered my custom wrapper had some rather non-obvious bugs.