Req #50815 [Com]: Implement 323 short password hash fallback in mysqlnd

Edit report at https://bugs.php.net/bug.php?id=50815&edit=1 ID: 50815 Comment by: toddr at cpanel dot net Reported by: jd at cpanel dot net Summary: Implement 323 short password hash fallback in mysqlnd Status: Wont fix Type: Feature/Change Request Package: MySQL related Operating System: any PHP Version: 5.3.1 Assigned To: mysql Block user comment: N Private report: N New Comment: If you want to discourage use of the short password method, couldn't you just add a configure option to enable this and disable it by default? Previous Comments: ------------------------------------------------------------------------ [2012-10-26 17:11:47] toddr at cpanel dot net If all MySQL 5 versions support this hashing scheme, Aren't you kinda overriding a user decision to enable short passwords on their MySQL server? It's also not clear when the failure happens what the problem is. ------------------------------------------------------------------------ [2010-08-27 06:00:08] aharvey@php.net Fix up the package to make this easier to search for. ------------------------------------------------------------------------ [2010-08-26 13:31:35] uw@php.net We mysql guys have no plans adding old insecure password stuff to mysqlnd. As it is assigned to us/me, I'm changing status to what shall be status from our/my perspective: won't fix. ------------------------------------------------------------------------ [2010-03-03 16:57:40] chris at geartech dot org I am running into this issue with mysqlnd as well; at my work we must keep old passwords on a few daemons to ensure backwards compatibility with proprietary software. MySQL's website (checking the 5.1 & 5.5 documentation) doesn't have the old password format deprecated in the newer versions, it's merely discouraged. While I agree that it is an insecure format and deprecating/removing support of it would be ideal, but it seems like support for this password scheme will exist in (major) future versions. ------------------------------------------------------------------------ [2010-01-21 19:17:49] jd at cpanel dot net I'd agree with you there. They should be using the long hashes. The problem is when you have a system that's been in place for a very long time and the passwords haven't ever changed. The short hashes are still in the user table and the existing libmysqlclient happily connects with them. For some users this makes switching to mysqlnd a very difficult process. You need to force all of these old account to reenter their passwords so they can be rehashed. The main point is that if it's insecure to the point where it's worth breaking backward compatability, why do the latest versions of libmysqlclient continue to provide this functionality? The short hashes in the user table are the security problem, not the ability to send them from the client side, right? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=50815 -- Edit this bug report at https://bugs.php.net/bug.php?id=50815&edit=1