41–44 of 44 posts
Just noting if you're new to this you don't have to add a salt, by default password_hash with bcrypt will add a random one to each password.
How does that work? Don't you need the original salt to verify the hash?
Earlier quoted context omitted.
You can even do simpler. On signup store: $password = password_hash(md5($password),PASSWORD_BCRYPT); And on login: password_verify(md5($password), $password_hash); Then you just have apply password_hash() on all you passwords in database. Bonus the migration is instantaneous, you don't need a 6 month transition period. IMHO it do not reduce the security, but i'm not a crypto expert though.
It does add extra computational power to your log in though. While it is a minimal amount, depending on the size of your application it could be notable.
So adding an extra md5 hashing is totally insignificant (in term of computation).
As another option, you can also just not build any password infrastructure. We do all the hashing and authorization as a secure service and there are PHP devs of all levels using it... http://www.stormpath.com/docs/php/quickstart
Earlier quoted context omitted.
How does that work? Don't you need the original salt to verify the hash?
The salt is stored in the hash itself, so it can extract the salt from any provided hash. (Neat huh?)
http://pythonhosted.org/passlib/lib/passlib.hash.bcrypt.html...