note 52023 deleted from function.crypt by betz
| From: | betz@php.net | Date: | Tue, 19 Apr 2005 09:40:55 +0000 |
| Subject: | note 52023 deleted from function.crypt by betz | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-88201@lists.php.net to get a copy of this message | ||
Note Submitter: trashcanman23 at hotmail dot com
Reason: useless
----
>icecube at fr dot fm 07-Mar-2002 09:53
>To generate a .htaccess-based authentication with DES,
>you have to use the first two characters of your password
>as salt.
This is a _really_ bad idea, seeing how the two first letters of your password will be reveiled,
effectively reducing the quality of your password.
Your example assigns "sonH/h2hpGtHk" to $ht_pass, where "so" of course are the
first to letters in something. Try it out for yourself. Switching the password to
"icecube" gives "ickJ.ZxzjXpNE" as the output. Get my point?
The salt is always included in the encrypted string. Use a random salt instead.