note 108704 deleted from function.crypt by googleguy
| From: | googleguy@php.net | Date: | Sat, 06 Feb 2016 07:38:27 +0000 |
| Subject: | note 108704 deleted from function.crypt by googleguy | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-204881@lists.php.net to get a copy of this message | ||
Note Submitter: Matteo
----
Password hashing should be done only with crypt and NEVER with SHA* and MD5 or hash(). The
fundamental reason is that crypt is designed to be SLOW which is a VERY good thing for password
hashing.
It also automatically generate a salt every time which makes pre-computed tables to
"decrypt" passwords useless (the generated salt is stored in the returned string for
convenience).