Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75572
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.176 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <61F23F13-DC8D-4C6B-A25C-E9B58B5EE602@ajf.me>
References: <CAGa2bXYP4L-EVjqiTvrOjbiRvzQJ7zyTQyu78O1AEEkk7nwEhQ@mail.gmail.com>
 <61F23F13-DC8D-4C6B-A25C-E9B58B5EE602@ajf.me>
Date: Wed, 16 Jul 2014 10:45:24 +0900
Message-ID: <CAGa2bXZ63MXv-XXkP-+6kJUq_=_=co8k-UW-PjOhjSbTS2VXTg@mail.gmail.com>
To: Andrea Faulds <ajf@ajf.me>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e01227abcf5a80204fe45afeb
Subject: Re: [PHP-DEV] crypt() BC issue
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e01227abcf5a80204fe45afeb
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Andrea,

On Wed, Jul 16, 2014 at 10:12 AM, Andrea Faulds <ajf@ajf.me> wrote:

> > - Developer may use larger rounds and store updated hash when
> >   user is authenticated with old PHP.
> > - Developer may ask users to reset password if password hash has
> >   to fewer rounds than 1000 (i.e. outdated hash) with new PHP.
>
> Wait, doesn=E2=80=99t that mean you=E2=80=99re unable to verify passwords=
 now?


It means old PHP users may need preparation for their apps to
migrate newer PHP.

If developer upgrades PHP blindly, they may see a lots of failed logins.

This change was done while ago, so it would not worth the effort to relax
the requirement now. IMHO.

We may add optional flag to relax the limitation, though.
I don't mind modifying crypt() or adding migration INI setting.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e01227abcf5a80204fe45afeb--