4 ms·
Better: hash_equals() Best: use password_hash() and password_verify()
by sarciszewski 12y ago
Better: hash_equals()
Best: use password_hash() and password_verify()
- opless 12y agoor use the "is this really equal" operator '==='
- sarciszewski 12y agohttp://blog.astrumfutura.com/2010/10/nanosecond-scale-remote-timing-attacks-on-php-applications-time-to-take-them-seriously/ http://blog.astrumfutura.com/2010/10/nanosecond-scale-remote... For cryptographic secrets, password hashes, MACs, digital signatures, etc. use a comparison operator that runs in constant time. Ergo, hash_equals()