Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117108
Message-ID: <28ae01a2-b729-a71a-4390-e9f71cbde0c1@gmail.com>
Date: Mon, 21 Feb 2022 17:37:25 +0000
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.6.1
Content-Language: en-GB
To: internals@lists.php.net
References: <5983302.2649742.1645319015766@email.ionos.com>
 <6238bf00-011e-35cc-d84b-4082b4f05099@gmail.com>
 <497325306.1564942.1645357444018@email.ionos.com>
 <3c6871ca-589d-6812-800c-a3b9ad6bb575@bastelstu.be>
 <CADyq6sLWRfD2DJwRNWmX=s7rbA2Rs+Agu9tsW9mLQbCeJ27vwA@mail.gmail.com>
 <40015164-ac0c-336d-c7d6-c4766d6caff8@gmail.com>
 <CADyq6s+e_Jkwg1UoGS_e23=6FciRB2-d8q_NxkREMt45f=vs8g@mail.gmail.com>
 <b52c5f52-3295-7792-1897-c170bb132331@bastelstu.be>
 <1846031176.2904638.1645461835527@email.ionos.com>
In-Reply-To: <1846031176.2904638.1645461835527@email.ionos.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] RFC proposal to deprecate crypt()
From: rowan.collins@gmail.com (Rowan Tommins)

On 21/02/2022 16:43, steve@tobtu.com wrote:
> If crypt() is removed, you can still use password_verify() to verify all the password hashes created by crypt(). The only thing you lose is creating those bad password hashes. Which can be done in userland because most people aren't changing their passwords daily. So it will run that slow userland code infrequently.


What "slow userland code"? Is there an implementation of the legacy 
crypt hashing function in pure PHP out there somewhere? I certainly 
wouldn't be confident writing one.

Regards,

-- 
Rowan Tommins
[IMSoP]