Re: [PHP-DEV] crypt() should raise error without 2nd parameter

2013-08-07 Thread Yasuo Ohgaki
Hi Hannes, On Thu, Aug 8, 2013 at 1:22 PM, Hannes Magnusson wrote: > On Wed, Aug 7, 2013 at 6:20 PM, Yasuo Ohgaki wrote: > > Hi all, > > > > It seems there are 2 options for master branch when crypt()'s 2nd > parameter > > is omitted. > > > > - raise E_DEPRECIATED that advice use of stronger s

Re: [PHP-DEV] crypt() should raise error without 2nd parameter

2013-08-07 Thread Hannes Magnusson
On Wed, Aug 7, 2013 at 6:20 PM, Yasuo Ohgaki wrote: > Hi all, > > It seems there are 2 options for master branch when crypt()'s 2nd parameter > is omitted. > > - raise E_DEPRECIATED that advice use of stronger salt or password_hash() >and make 2nd parameter required for future release. >

Re: [PHP-DEV] crypt() should raise error without 2nd parameter

2013-08-07 Thread Yasuo Ohgaki
Hi all, It seems there are 2 options for master branch when crypt()'s 2nd parameter is omitted. - raise E_DEPRECIATED that advice use of stronger salt or password_hash() and make 2nd parameter required for future release. - make crypt() use stronger default salt/hash w/o error Since pas

Re: [PHP-DEV] crypt() should raise error without 2nd parameter

2013-08-07 Thread Stas Malyshev
Hi! > A user requested that crypt() should raise error without 2nd(slat) > parameter. > > https://bugs.php.net/bug.php?id=55036 > > crypt() without salt generates extremely weak password hash. In addition to > this, I see that when I run crypt with one parameter, it generates salted password ha

Re: [PHP-DEV] crypt() should raise error without 2nd parameter

2013-08-07 Thread Anthony Ferrara
Yasuo, Hi all, > > A user requested that crypt() should raise error without 2nd(slat) > parameter. > > https://bugs.php.net/bug.php?id=55036 > > crypt() without salt generates extremely weak password hash. In addition to > this, > PHP 5.5 has password_hash() > > This change should be applied from

Re: [PHP-DEV] crypt() should raise error without 2nd parameter

2013-08-07 Thread Kalle Sommer Nielsen
Hi Yasuo 2013/8/7 Yasuo Ohgaki : > Hi all, > > A user requested that crypt() should raise error without 2nd(slat) > parameter. > > https://bugs.php.net/bug.php?id=55036 > > crypt() without salt generates extremely weak password hash. In addition to > this, > PHP 5.5 has password_hash() > > This ch

Re: [PHP-DEV] crypt() should raise error without 2nd parameter

2013-08-07 Thread Ángel González
On 07/08/13 13:00, Leigh wrote: On 7 August 2013 11:18, Yasuo Ohgaki wrote: A user requested that crypt() should raise error without 2nd(slat) parameter. https://bugs.php.net/bug.php?id=55036 crypt() without salt generates extremely weak password hash. The docs seem to indicate that some i

Re: [PHP-DEV] crypt() should raise error without 2nd parameter

2013-08-07 Thread Leigh
On 7 August 2013 11:18, Yasuo Ohgaki wrote: > A user requested that crypt() should raise error without 2nd(slat) > parameter. > > https://bugs.php.net/bug.php?id=55036 > > crypt() without salt generates extremely weak password hash. > The docs seem to indicate that some implementations generate

[PHP-DEV] crypt() should raise error without 2nd parameter

2013-08-07 Thread Yasuo Ohgaki
Hi all, A user requested that crypt() should raise error without 2nd(slat) parameter. https://bugs.php.net/bug.php?id=55036 crypt() without salt generates extremely weak password hash. In addition to this, PHP 5.5 has password_hash() This change should be applied from 5.5, IMHO. Any comments?