Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:85602
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.41 as permitted sender)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 8.0 \(1974.6\))
In-Reply-To: <551AF662.3070008@gmx.de>
Date: Tue, 31 Mar 2015 22:02:26 +0200
Content-Transfer-Encoding: quoted-printable
Message-ID: <E58E5328-F365-47CD-806B-3E7DFCAFD53E@gmail.com>
References: <CAAyV7nGRU6J=-VRJ48=U4wNgE9vpk2k3fvz9MLnC2-VoCsyGRw@mail.gmail.com> <0CB1052E-0245-406D-8CF0-83E0D75CD049@gmail.com> <551AF662.3070008@gmx.de>
To: internals@lists.php.net
Subject: Re: [PHP-DEV] password_hash() deprecate salt option - thoughts?
From: nicoswd@gmail.com (Nico)


> On 31 Mar 2015, at 21:32, Christoph Becker <cmbecker69@gmx.de> wrote:
>=20
> Nicolas Oelgart wrote:
>=20
>>> On 31 Mar 2015, at 20:49, Anthony Ferrara <ircmaxell@gmail.com> =
wrote:
>>>=20
>>> So I'd like to hear your thoughts about raising E_DEPRECATED when =
the
>>> salt option is specified in 7.0, with ultimately removing the option
>>> in a later version.
>>=20
>> +1
>>=20
>> I'd even go as far as adding a big red warning about custom salts to =
the manual page.=20
>=20
> FWIW, there is already the following note:
>=20
> | Caution It is strongly recommended that you do not generate your own
> | salt for this function. It will create a secure salt automatically
> | for you if you do not specify one.
>=20
> --=20
> Christoph M. Becker
>=20

Yeah, I=E2=80=99m aware. But I don=E2=80=99t think it=E2=80=99s enough. =
I=E2=80=99d suggest moving it further to the top, and making it red. As =
Anthony=E2=80=99s research shows, the current note is not enough. People =
are still doing it wrong.

=E2=80=94
Nico=