bcrypt warning on long passwords
| From: | Rob Landers | Date: | Sun, 09 Feb 2025 10:03:55 +0000 |
| Subject: | bcrypt warning on long passwords | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-126359@lists.php.net to get a copy of this message | ||
Hello internals,
I saw the following on hacker-news the other day: https://news.ycombinator.com/item?id=42955176
In the article it talks about how many implementations do not emit a warning, and PHP is one of them
(though the author didn't cover php explicitly).
You can see this play out here: https://3v4l.org/8ih6O
Since adding a warning here would be a BC break, does this need an RFC? I'd be happy to
implement this and write the RFC if necessary.
— Rob