Creating and Verifying Hashes in PHP 5.5
jcurcio.com
Creating and Verifying Hashes in PHP 5.5
1–10 of 44 posts
Re: Creating and Verifying Hashes in PHP 5.5
#2Thanks for easily explaining this for everyone.
Re: Creating and Verifying Hashes in PHP 5.5
#3If you are using a PHP https://github.com/ircmaxell/password_compat
Re: Creating and Verifying Hashes in PHP 5.5
#4There's also a library for PHP >= 5.3.7 that provides the same API if PHP 5.5 isn't an option yet.
https://github.com/ircmaxell/password_compat
Written by Anthony Ferrara, the same guy behind the `password_*` API in PHP 5.5
Re: Creating and Verifying Hashes in PHP 5.5
#5This is a great addition to PHP. Before, most new devs would either skip hashing passwords altogether or use `md5()` or `sha1()`. So you'd end up with databases with passwords in plaintext or easily cracked. Bcrypt frameworks for PHP were too confusing for beginners. If you were lucky you were using a framework that took care of hashing and salting passwords and if you were extremely lucky you had bcrypt available on your PHP install and that framework used it.
But that didn't always happen. There do exist experienced PHP devs who would do password storage the right way but PHP up until now neither made it easy nor encourage these practices as they relate to passwords. Now I hope word gets out about this and people stop using md5() thinking their passwords are safe. Not that md5 is necessarily bad, but most people don't realize there are better tools for maintaining secure passwords.
Also, this reminds me a little bit of `has_secure_password` method in Rails minus some of the automation that comes with it.
Re: Creating and Verifying Hashes in PHP 5.5
#6There's also a library for PHP >= 5.3.7 that provides the same API if PHP 5.5 isn't an option yet. https://github.com/ircmaxell/password_compat Written by Anthony Ferrara, the same guy behind the `password_*` API in PHP 5.5
There's also PHPass from OpenWall:
Re: Creating and Verifying Hashes in PHP 5.5
#7[deleted]
Re: Creating and Verifying Hashes in PHP 5.5
#8Just noting if you're new to this you don't have to add a salt, by default password_hash with bcrypt will add a random one to each password.
Re: Creating and Verifying Hashes in PHP 5.5
#9> 'salt' => password_hash("MySalt",PASSWORD_BCRYPT)]
This is really, really dumb and pointless. In fact it makes absolutely no sense, it tells password_hash to use a bcrypted "MySalt" as a salt.
Not only is there no reason to explicitly provide a salt unless you already have bcrypted passwords in a non-standard format, (in which case you'd pass the existing $salt directly, you wouldn't bcrypt it) this is an inane way to generate one.
If you want to generate your salt by hand, don't do it. If you really, really, really want to, use mcrypt_create_iv.
Re: Creating and Verifying Hashes in PHP 5.5
#10[deleted]