Re: Re: [RFC][DISCUSSION] Argon2 Password Hash
| From: | Tom Worster | Date: | Fri, 05 Aug 2016 15:21:44 +0000 |
| Subject: | Re: Re: [RFC][DISCUSSION] Argon2 Password Hash | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-94862@lists.php.net to get a copy of this message | ||
On 8/5/16, 11:08 AM, "Ryan Pallas" <derokorian@gmail.com> wrote:
>Please keep it so that defaults will work, but $options is available for
>tuning as that's how the feature currently works.
My suggestion doesn't affect that. I agree that password_hash($password,
PASSWORD_DEFAULT) should always "just work".
Instead, I think there should be an interim status, before changing
PASSWORD_DEFAULT, in which password_hash($password, PASSWORD_ARGON2I)
requires $options. Reasons given in my first reply.
There is no hurry to change PASSWORD_DEFAULT, afaik.
Tom