Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72126
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.169 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <alpine.DEB.2.10.1402031006310.6067@whisky.home.derickrethans.nl>
References: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
 <alpine.DEB.2.10.1402031006310.6067@whisky.home.derickrethans.nl>
Date: Tue, 4 Feb 2014 06:25:38 +0900
Message-ID: <CAGa2bXZ_2qV7NR8NtsQa5FwZqUpss3+EVQ1uM98dHKGvx2_X3Q@mail.gmail.com>
To: Derick Rethans <derick@php.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b3a83009cdc6604f1872c2d
Subject: Re: [PHP-DEV] Extending uniqid() or not?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--047d7b3a83009cdc6604f1872c2d
Content-Type: text/plain; charset=UTF-8

Hi Derick,

On Mon, Feb 3, 2014 at 7:08 PM, Derick Rethans <derick@php.net> wrote:

> > uniqid() is producing unique ID for the system which is good for email's
> > message ID etc. Many users are using uniqid() as secure unique ID which
> is
> > very bad thing to do for security.
> >
> > It may be extend to produce safe unique ID
> >
> >  string uniqid(TRUE) - Returns random ID string which is safe to use
> > security purposes.
>
> I have always been of the opinion that function's internal workings
> should not be affected by an option like this.


To be honest, I don't like it neither :) That's the reason why I did not
write RFC for  it.


>  > My concern is that uniqid() return both safe and unsafe ID which may
> > not be good. We may better to have new function, perhaps
> >
> >  string safe_uniqid([ing $length=64])
>
> Yes, I agree - but we should not make the mistake of calling the
> function "safe_" ... firstly because it reminds me of "safe_mode", but
> more importantly is that *we* still can't guarantee it's safe. The
> underlaying RNG sources are not under out control.


I agree. The name is stupid ;)
I would like to have 'default' secure ID generator which we do not have
currently. This is my point.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--047d7b3a83009cdc6604f1872c2d--