note 109002 added to faq.passwords

The security issue with simple hashing (md5 et al) isn't really the speed, so much as the fact that it's idempotent; two different people with the same password will have the same hash, and so if one person's hash is brute-forced, the other one will as well. This facilitates rainbow attacks. Simply slowing the hash down isn't a very useful tactic for improving security. It doesn't matter how slow and cumbersome your hash algorithm is - as soon as someone has a weak password that's in a dictionary, EVERYONE with that weak password is vulnerable. Also, hash algorithms such as md5 are for the purpose of generating a digest and checking if two things are probably the same as each other; they are not intended to be impossible to generate a collision for. Even if an underlying password itself requires a lot of brute forcing to determine, that doesn't mean it will be impossible to find some other bit pattern that generates the same hash in a trivial amount of time. As such: please, please, PLEASE only use salted hashes for password storage. There is no reason to implement your own salted hash mechanism, either, as crypt() already does an excellent job of this. ---- Server IP: 208.69.120.55 Probable Submitter: 173.230.196.25 ---- Manual Page -- http://www.php.net/manual/en/faq.passwords.php Edit -- https://master.php.net/note/edit/109002 Del: integrated -- https://master.php.net/note/delete/109002/integrated Del: useless -- https://master.php.net/note/delete/109002/useless Del: bad code -- https://master.php.net/note/delete/109002/bad+code Del: spam -- https://master.php.net/note/delete/109002/spam Del: non-english -- https://master.php.net/note/delete/109002/non-english Del: in docs -- https://master.php.net/note/delete/109002/in+docs Del: other reasons-- https://master.php.net/note/delete/109002 Reject -- https://master.php.net/note/reject/109002 Search -- https://master.php.net/manage/user-notes.php