note 116672 added to function.crypt

The #2 comment on this comments page (as of Feb 2015) is 9 years old and recommends phpass. I have independently security audited this product and, while it continues to be recommended for password security, it is actually insecure and should NOT be used. It hasn't seen any updates in years (still at v0.3) and there are more recent alternatives such as using the newer built-in PHP password_hash() function that are much better. Everyone, please take a few moments to confirm what I'm saying is accurate (i.e. review the phpass code for yourself) and then click the down arrow to sink the phpass comment to the bottom. You'll be increasing security across the Internet by doing so. For those who want details: md5() with microtime() are a fallback position within the source code of phpass. Instead of terminating, it continues to execute code. The author's intentions of trying to work everywhere are admirable but, when it comes to application security, that stance actually backfires. The only correct answer in a security context is to terminate the application rather than fallback to a weak position that can potentially be exploited (usually by forcing that weaker position to happen). ---- Server IP: 72.52.91.14 Probable Submitter: 65.129.181.219 ---- Manual Page -- http://php.net/manual/en/function.crypt.php Edit -- https://master.php.net/note/edit/116672 Del: integrated -- https://master.php.net/note/delete/116672/integrated Del: useless -- https://master.php.net/note/delete/116672/useless Del: bad code -- https://master.php.net/note/delete/116672/bad+code Del: spam -- https://master.php.net/note/delete/116672/spam Del: non-english -- https://master.php.net/note/delete/116672/non-english Del: in docs -- https://master.php.net/note/delete/116672/in+docs Del: other reasons-- https://master.php.net/note/delete/116672 Reject -- https://master.php.net/note/reject/116672 Search -- https://master.php.net/manage/user-notes.php