Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94357
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.50 as permitted sender)
MIME-Version: 1.0
References: <CAGa2bXaSkozJLLtycujwmHyas9TofRw5s6JzG0EQQvPyU0pxNQ@mail.gmail.com>
In-Reply-To: <CAGa2bXaSkozJLLtycujwmHyas9TofRw5s6JzG0EQQvPyU0pxNQ@mail.gmail.com>
Date: Sat, 02 Jul 2016 08:16:58 +0000
Message-ID: <CAPwsocEffWVhzjNHVA853J+1VfmrhstZ0inihhQVHW=VfLS6Eg@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1142c028af4ec90536a2ba46
Subject: Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing
From: leight@gmail.com (Leigh)

--001a1142c028af4ec90536a2ba46
Content-Type: text/plain; charset=UTF-8

On Sat, 2 Jul 2016 at 08:36 Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> Currently session module uses obsolete MD5 for session ID. With
> CSPRNG, hashing is redundant and needless. It adds hash module
> dependency and inefficient (There is no reason to use hash for CSPRNG
> generated bytes).
>
> This proposal cleans up session code by removing hash.
>
> https://wiki.php.net/rfc/session-id-without-hashing
>
> I set vote requires 2/3 support.
> Please describe the reason why when you against this RFC. Reasons are
> important for improvements!
>

I support the idea proposed here, but I have issues with the
implementation. You've changed a lot of defaults that may break things for
some users (especially those using custom session handlers).

I'll add some notes on github.

--001a1142c028af4ec90536a2ba46--