News for hackers. Stuff that matters.

A comment on You are dangerously bad at cryptography. Parent comment

Re:You are dangerously bad at cryptography by jiggy2011 on Monday May 27, 2013 @03:11PM (#5776085)
Once you are choosing salts that is almost level 4 knowledge. This is one of the problems with "raw" PHP development, there's no way to say "this is a password field, make it secure" only "hash this with algorithm X".

To be fair though , I believe recent releases have addressed this and frameworks like symphony give you a default user class to inherit from that does things sensibly. It also sticks a seed for the salt directly in the config file (where devs will see it) and says "make sure you set this randomly and keep it secret".

[ Parent | on HN ]
Re:You are dangerously bad at cryptography by carbocation on Monday May 27, 2013 @09:02PM (#5777431)
Hmm, unfortunately I think Symfony2 runs passwords through 1 round of SHA1 unless a custom password "encoder" is used [1].

[1] = http://symfony.com/doc/2.0/book/security.html#encoding-the-u...

[ Parent | on HN ]
Re:You are dangerously bad at cryptography by terolacu on Monday May 27, 2013 @10:12PM (#5777631)
Bcrypt and PBKDF2 are not custom, they are part of the framework:

http://symfony.com/doc/current/reference/configuration/secur...

[ Parent | on HN ]
Re:You are dangerously bad at cryptography by carbocation on Monday May 27, 2013 @10:36PM (#5777708)
Those were added in Symfony2.2; my last experience was with 2.1. Also, I understand that neither of those is default; one should be.
[ Parent | on HN ]
Re:You are dangerously bad at cryptography by terolacu on Monday May 27, 2013 @10:09PM (#5777617)
> This is one of the problems with "raw" PHP development

... or any other language.

[ Parent | on HN ]