Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75696
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.218.49 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZGNfcgdCcSkgM_Ue2QEFuSeAgaRePM1==6NiLd3AWC9w@mail.gmail.com>
References: <CAGa2bXYP4L-EVjqiTvrOjbiRvzQJ7zyTQyu78O1AEEkk7nwEhQ@mail.gmail.com>
	<CAGa2bXbyRGWhtgu9t-D=qcf6nkBYHUNBpyfgCXkMLmFsgwcwuQ@mail.gmail.com>
	<CAF+90c-dZcDwrP=FosSR9=8RZdqWNTiP1y6t=E=m66FmV8u-9Q@mail.gmail.com>
	<CAGa2bXZGNfcgdCcSkgM_Ue2QEFuSeAgaRePM1==6NiLd3AWC9w@mail.gmail.com>
Date: Sat, 19 Jul 2014 14:50:25 +0300
Message-ID: <CAPhkiZy1Ay=SNpMwjsv0tqfNoBDWPdxjaJMYx1YQusOpm_HsdA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: internals@lists.php.net, Nikita Popov <nikita.ppv@gmail.com>
Content-Type: multipart/alternative; boundary=047d7b5d4840cdadd904fe8a7a56
Subject: Re: [PHP-DEV] Re: crypt() BC issue
From: narf@devilix.net (Andrey Andreev)

--047d7b5d4840cdadd904fe8a7a56
Content-Type: text/plain; charset=UTF-8

On Jul 19, 2014 11:45 AM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote:
>
> Hi Nikita,
>
> On Sat, Jul 19, 2014 at 2:46 PM, Nikita Popov <nikita.ppv@gmail.com>
wrote:
>
> > I'm against adding this notice to password_hash. This will require all
> > applications to ensure that passwords are shorter than 72 chars. I don't
> > think that's a good idea.
>
>
> Generally speaking, it would not be serious issue. 72 bytes constant
prefix
> would
> not be used most likely.
>
> However, bug like this in "authentication" code must be detected  and
> fixed.
> If password should be truncated, it should be truncated by app developers
> explicitly and
> notified users that their password had been truncated.  IMHO.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net

Hi,

There's already a notice about this in the password_hash() docs, one that
almost looks like is designed to scare users, which is bad. Throwing an
E_NOTICE will cause more problems than it would supposedly solve.

Application developers should just state this limitation on their
registration/password change pages, anything else is pointless.

Cheers,
Andrey.

--047d7b5d4840cdadd904fe8a7a56--