Re: [DRAFT RFC] Adding Simplified Password Hashing API

hi Anthony, On Tue, Jul 3, 2012 at 1:53 PM, Anthony Ferrara <ircmaxell@gmail.com> wrote: > Pierre, > > Getting back to the PASSWORD_DEFAULT discussion... > > I know you didn't like PASSWORD_MOST_SECURE. So what about keeping > PASSWORD_DEFAULT as a moving target, documented, and just making the > second parameter (algo) to password_hash required? That way users > could choose between PASSWORD_BCRYPT and PASSWORD_DEFAULT. > > That way, over time, PASSWORD_DEFAULT could be updated, and it would > be documented that it would change. But it would require them to > understand that it could change... > > Would that satisfy your issues? Yes. Using this constant name and clearly document its changing nature is fine. The argument being required fully solves my worry about optional argument with changing default value. Thanks for your efforts and work! Cheers, -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org