Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60839
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAF+90c-6VWJ_kBW=Z8Br-NOxKyuTkwStRg-OMBa6844w3=CjDA@mail.gmail.com>
References: <CAF+90c-6VWJ_kBW=Z8Br-NOxKyuTkwStRg-OMBa6844w3=CjDA@mail.gmail.com>
Date: Thu, 14 Jun 2012 11:42:39 -0700
Message-ID: <CAKOpQSzHLWhQxe9D2hjAo+O4AevoAEL4vFAhkoyxiZS8fvc3GA@mail.gmail.com>
To: Nikita Popov <nikita.ppv@googlemail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=0016e6d59e4b758fe704c2731017
Subject: Re: [PHP-DEV] Adding a simple API for secure password hashing?
From: kris.craig@gmail.com (Kris Craig)

--0016e6d59e4b758fe704c2731017
Content-Type: text/plain; charset=ISO-8859-1

On Wed, Jun 13, 2012 at 2:31 PM, Nikita Popov <nikita.ppv@googlemail.com>wrote:

> Hi internals!
>
> Recent incidents have shown that even very large websites still don't
> get how to do password hashing properly. The sha1 hashes used by
> Linkedin et al can be easily cracked even by amateurs without special
> hardware.
>

LinkedIn was using sha1?!  Are you fucking serious??  I think it's time for
me to change my password there to something I'm *not* using anywhere else
lol.

At this rate, tomorrow are we going to learn that Gmail uses md5 and that
Facebook passwords are stored in plaintext files under the HTTP root?....


Anyway, BIG +1 on this RFC!

--Kris

--0016e6d59e4b758fe704c2731017--