6 ms·

in general anything coming from a php developer should be ignored. even reading official php documentation when it comes to anything concerning security should

by cyphunk 12y ago

in general anything coming from a php developer should be ignored. even reading official php documentation when it comes to anything concerning security should scare the shit out of grandmothers everywhere.

sarciszewski 12y ago
The documentation has actually been going through a clean-up lately. For example, http://php.net/manual/en/function.crypt.php#refsect1-function.crypt-returnvalues http://php.net/manual/en/function.crypt.php#refsect1-functio... Do you have any specific examples of bad security advice in the documentation? I can try to raise hell with the doc maintainers and maybe even suggest an amendment.
- FraaJad 12y ago
  The first thing i did after reading the post was to check the official documentation. The docs are explicit about not using MD5 for hashing password. Good on PHP doc maintainers.
- mercurial 12y ago
  I see that MySQL's documentation [1] recommends SHA2: > Exploits for the MD5 and SHA-1 algorithms have become known. You may wish to consider using one of the other encryption functions described in this section instead, such as SHA2(). Further down: > The PASSWORD() function is used by the authentication system in MySQL Server; you should not use it in your own applications. For that purpose, consider MD5() or SHA2() instead. Also see RFC 2195, section 2 (Challenge-Response Authentication Mechanism (CRAM)), for more information about handling passwords and authentication securely in your applications. 1: http://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html#function_password http://dev.mysql.com/doc/refman/5.5/en/encryption-functions....
  - sarciszewski 12y ago
    I may have voted this comment up, but it makes me feel very :( Related, the only hashing algorithm supported by postgresql for authenticating to the pgsql server is md5.
    - mercurial 12y ago
      Let's see: > If you are at all concerned about password "sniffing" attacks then md5 is preferred. Plain password should always be avoided if possible. However, md5 cannot be used with the db_user_namespace feature. If the connection is protected by SSL encryption then password can be used safely (though SSL certificate authentication might be a better choice if one is depending on using SSL). Strongly implies that md5sum offers protection from an attacker sophisticated enough to sniff passwords of the network. Snif.
    - marcosdumay 12y ago
      Take a look at the docs. MD5 is an option for network transportation of the password - almost the entire world transports it in plain text. It's a "you are doing it wrong if you need this, but it won't hurt if you don't need - so we'll keep it" feature, with the correct recomendation (using SSL) made all around. Anyway, the password will be stored in plain-text just a few servers away. It has to be. Whatever hash they use, hashing it will be as useless.

by cyphunk 12y ago

sarciszewski 12y ago

The documentation has actually been going through a clean-up lately. For example, http://php.net/manual/en/function.crypt.php#refsect1-function.crypt-returnvalues http://php.net/manual/en/function.crypt.php#refsect1-functio... Do you have any specific examples of bad security advice in the documentation? I can try to raise hell with the doc maintainers and maybe even suggest an amendment.

FraaJad 12y ago
The first thing i did after reading the post was to check the official documentation. The docs are explicit about not using MD5 for hashing password. Good on PHP doc maintainers.
mercurial 12y ago
I see that MySQL's documentation [1] recommends SHA2: > Exploits for the MD5 and SHA-1 algorithms have become known. You may wish to consider using one of the other encryption functions described in this section instead, such as SHA2(). Further down: > The PASSWORD() function is used by the authentication system in MySQL Server; you should not use it in your own applications. For that purpose, consider MD5() or SHA2() instead. Also see RFC 2195, section 2 (Challenge-Response Authentication Mechanism (CRAM)), for more information about handling passwords and authentication securely in your applications. 1: http://dev.mysql.com/doc/refman/5.5/en/encryption-functions.html#function_password http://dev.mysql.com/doc/refman/5.5/en/encryption-functions....
- sarciszewski 12y ago
  I may have voted this comment up, but it makes me feel very :( Related, the only hashing algorithm supported by postgresql for authenticating to the pgsql server is md5.
  - mercurial 12y ago
    Let's see: > If you are at all concerned about password "sniffing" attacks then md5 is preferred. Plain password should always be avoided if possible. However, md5 cannot be used with the db_user_namespace feature. If the connection is protected by SSL encryption then password can be used safely (though SSL certificate authentication might be a better choice if one is depending on using SSL). Strongly implies that md5sum offers protection from an attacker sophisticated enough to sniff passwords of the network. Snif.
  - marcosdumay 12y ago
    Take a look at the docs. MD5 is an option for network transportation of the password - almost the entire world transports it in plain text. It's a "you are doing it wrong if you need this, but it won't hurt if you don't need - so we'll keep it" feature, with the correct recomendation (using SSL) made all around. Anyway, the password will be stored in plain-text just a few servers away. It has to be. Whatever hash they use, hashing it will be as useless.