note 53547 added to security.database.storage

Using a hard coded salt will only prevent a dictionary attack on the raw database and only if the attacker hasn't gained access to the file the salt is stored in. The attacker could still use the php login site to run a dictionary attack, since the php would be adding the hard coded salt to the password, md5ing it, and checking if it matches. The only real way to prevent a dictionary attack is to not allow weak passwords. There is no shortcuts in real security. ---- Manual Page -- http://www.php.net/manual/en/security.database.storage.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+53547 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+53547&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+53547&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+53547&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+53547&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+53547&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+53547&report=yes Search -- http://master.php.net/manage/user-notes.php