Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117107
MIME-Version: 1.0
References: <5983302.2649742.1645319015766@email.ionos.com>
 <6238bf00-011e-35cc-d84b-4082b4f05099@gmail.com> <497325306.1564942.1645357444018@email.ionos.com>
 <3c6871ca-589d-6812-800c-a3b9ad6bb575@bastelstu.be> <CADyq6sLWRfD2DJwRNWmX=s7rbA2Rs+Agu9tsW9mLQbCeJ27vwA@mail.gmail.com>
 <40015164-ac0c-336d-c7d6-c4766d6caff8@gmail.com> <CADyq6s+e_Jkwg1UoGS_e23=6FciRB2-d8q_NxkREMt45f=vs8g@mail.gmail.com>
 <b52c5f52-3295-7792-1897-c170bb132331@bastelstu.be> <1846031176.2904638.1645461835527@email.ionos.com>
In-Reply-To: <1846031176.2904638.1645461835527@email.ionos.com>
Date: Mon, 21 Feb 2022 17:35:33 +0000
Message-ID: <CAFv4g+ERLkttfdJKyTcv6pRF8OQXtF+5sDzvoUEZYndVPjp7Zg@mail.gmail.com>
To: steve@tobtu.com
Cc: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>, 
	Marco Pivetta <ocramius@gmail.com>, Stanislav Malyshev <smalyshev@gmail.com>, 
	PHP Internals List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000082cf0b05d88aa91b"
Subject: Re: [PHP-DEV] RFC proposal to deprecate crypt()
From: craig@craigfrancis.co.uk (Craig Francis)

--00000000000082cf0b05d88aa91b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, 21 Feb 2022 at 16:44, <steve@tobtu.com> wrote:

> If crypt() is removed [...] The only thing you lose is creating those bad
> password hashes.



That's not exactly fair, as noted by Tim, `crypt()` can be used for other
software (e.g. Dovecot); and by Hans for modifying `/etc/shadow`.

While I would warn most developers away from using crypt(), because it is
dangerous, it can still be useful (dare I say it, md5, terrible idea, but
sometimes you need it when integrating with other systems).

Craig


On Mon, 21 Feb 2022 at 10:11, Tim D=C3=BCsterhus <tim@bastelstu.be> wrote:

> crypt() allows one to interoperate with non-PHP-software that does not
> support BCrypt, but supports the SHA-X variants. I already mentioned
> Dovecot as an example.


On Mon, 21 Feb 2022 at 12:04, Hans Henrik Bergan <divinity76@gmail.com>
wrote:

> script modifying a linux system's /etc/passwd / /etc/shadow using crypt()
> because password_hash() couldn't create passwd/shadow-compatible hashes
> while crypt() could

--00000000000082cf0b05d88aa91b--