note 52051 deleted from function.crypt by joey
| From: | joey@php.net | Date: | Mon, 27 Dec 2010 12:19:56 +0000 |
| Subject: | note 52051 deleted from function.crypt by joey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-175227@lists.php.net to get a copy of this message | ||
Note Submitter: kevin at sylandroXgetridofthisbitX dot com
----
Even worse, using the first two letters of the password as the salt removes the whole point of
having salt in the first place, which is that without it, it's trivial to create a dictionary
of passwords-to-encrypted-passwords. Without salt (or with using a salt directly derived from the
password) there's only one possible encrypted password per password. With the two character
salt, there's 4096, which makes the idea a lot less feasible.