note 103583 added to security.database.storage

Using functions to obfuscate the hash generation does not increase security. This is security by obscurity. The algorithm used to hash the data needs to be secure by itself. I would not suggest to use other data as salt. For example if you use the username, you won't be able to change the values without rehashing the password. I would use a dedicated salt value stored in the same database table. Why? Because a lot of users use the same login credentials on different web services. And in case another service also uses the username as salt, the resulting hashed password might be the same! Also an attacker may prepare a rainbow table with prehashed passwords using the username and other known data as salt. Using random data would easily prevent this with little programming effort. ---- Server IP: 69.147.83.197 Probable Submitter: 193.103.207.10 ---- Manual Page -- http://www.php.net/manual/en/security.database.storage.php Edit -- https://master.php.net/note/edit/103583 Del: integrated -- https://master.php.net/note/delete/103583/integrated Del: useless -- https://master.php.net/note/delete/103583/useless Del: bad code -- https://master.php.net/note/delete/103583/bad+code Del: spam -- https://master.php.net/note/delete/103583/spam Del: non-english -- https://master.php.net/note/delete/103583/non-english Del: in docs -- https://master.php.net/note/delete/103583/in+docs Del: other reasons-- https://master.php.net/note/delete/103583 Reject -- https://master.php.net/note/reject/103583 Search -- https://master.php.net/manage/user-notes.php