Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75695
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.52 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAF+90c-dZcDwrP=FosSR9=8RZdqWNTiP1y6t=E=m66FmV8u-9Q@mail.gmail.com>
References: <CAGa2bXYP4L-EVjqiTvrOjbiRvzQJ7zyTQyu78O1AEEkk7nwEhQ@mail.gmail.com>
 <CAGa2bXbyRGWhtgu9t-D=qcf6nkBYHUNBpyfgCXkMLmFsgwcwuQ@mail.gmail.com> <CAF+90c-dZcDwrP=FosSR9=8RZdqWNTiP1y6t=E=m66FmV8u-9Q@mail.gmail.com>
Date: Sat, 19 Jul 2014 17:44:14 +0900
Message-ID: <CAGa2bXZGNfcgdCcSkgM_Ue2QEFuSeAgaRePM1==6NiLd3AWC9w@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1134daee5a08ed04fe87e39d
Subject: Re: [PHP-DEV] Re: crypt() BC issue
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1134daee5a08ed04fe87e39d
Content-Type: text/plain; charset=UTF-8

Hi Nikita,

On Sat, Jul 19, 2014 at 2:46 PM, Nikita Popov <nikita.ppv@gmail.com> wrote:

> I'm against adding this notice to password_hash. This will require all
> applications to ensure that passwords are shorter than 72 chars. I don't
> think that's a good idea.


Generally speaking, it would not be serious issue. 72 bytes constant prefix
would
not be used most likely.

However, bug like this in "authentication" code must be detected  and
fixed.
If password should be truncated, it should be truncated by app developers
explicitly and
notified users that their password had been truncated.  IMHO.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1134daee5a08ed04fe87e39d--