note 52022 deleted from function.crypt by joey
| From: | joey@php.net | Date: | Mon, 27 Dec 2010 12:20:06 +0000 |
| Subject: | note 52022 deleted from function.crypt by joey | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-175228@lists.php.net to get a copy of this message | ||
Note Submitter:
----
>icecube at fr dot fm 07-Mar-2002 09:53
>To generate a .htaccess-based authentication with DES,
>you have to use the first two characters of your password
>as salt.
This is a _really_ bad idea, seeing how the two first letters of your password will be reveiled,
effectively reducing the quality of your password.
Your example assigns "sonH/h2hpGtHk" to $ht_pass, where "so" of course are the
first to letters in something. Try it out for yourself. Switching the password to
"icecube" gives "ickJ.ZxzjXpNE" as the output. Get my point?
The salt is always included in the encrypted string. Use a random salt instead.