Tweak the title and depersonalize the password hashing FAQ section #3796
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Girgias
reviewed
Sep 27, 2024
faq/passwords.xml
Outdated
Comment on lines
87
to
91
| Another option is the <function>crypt</function> function, which | ||
| supports several hashing algorithms. When using | ||
| this function, you are guaranteed that the algorithm you select is | ||
| this function, it is guaranteed that the algorithm selected is | ||
| available, as PHP contains native implementations of each supported | ||
| algorithm, in case one or more are not supported by your system. | ||
| algorithm, in case one or more are not supported by the system. |
There was a problem hiding this comment.
I don't think I would recommend crypt(), the recommendation should really just be password_hash()
There was a problem hiding this comment.
Okay, tackled the TODO that was already there. Just mention crypt() in passing now and leave the text discouraging its use.
cmb69
approved these changes
Sep 27, 2024
Girgias
approved these changes
Sep 29, 2024
faq/passwords.xml
Outdated
Comment on lines
142
to
143
| <function>password_verify</function> or <function>crypt</function> when | ||
| verifying passwords. |
There was a problem hiding this comment.
password_verify() can be used with outputs from crypt() so maybe drop the implicit suggestion that one can compare two crypt hashes? (something something timing attacks)
There was a problem hiding this comment.
Good point, and because I cut out the other (longer) reference to timing attacks, I've added in a new warning.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.