Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117073
Message-ID: <6238bf00-011e-35cc-d84b-4082b4f05099@gmail.com>
Date: Sun, 20 Feb 2022 00:10:57 -0700
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Firefox/91.0 Thunderbird/91.6.0
Content-Language: en-US
To: internals@lists.php.net
References: <5983302.2649742.1645319015766@email.ionos.com>
In-Reply-To: <5983302.2649742.1645319015766@email.ionos.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] RFC proposal to deprecate crypt()
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

On 2/19/22 6:03 PM, steve@tobtu.com wrote:
> crypt() should be deprecate because it can be used to create bad password hashes:

I don't think it's a good reason for deprecating functions. A lot of 
functions, if used incorrectly, could produce bad results, it's not the 
reason to not use them correctly.

> Since password_verify() and password_needs_rehash() already supports hashes created with crypt(), the only thing needed to do is remove crypt().

Removing it would cause serious BC issues with no practical gain.

-- 
Stas Malyshev
smalyshev@gmail.com