Re: session management

Path	csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From	"Christoph M. Becker" <cmbecker69@arcor.de>
Newsgroups	comp.lang.php
Subject	Re: session management
Date	Fri, 13 Mar 2015 02:54:01 +0100
Organization	solani.org
Lines	32
Message-ID	<mdtfvf$22i$1@solani.org> (permalink)
References	<54f7fce9$0$2983$426a74cc@news.free.fr> <54f835eb$0$2851$e4fe514c@news2.news.xs4all.nl> <54f8450f$0$3374$426a34cc@news.free.fr> <54f8578f$0$2896$e4fe514c@news2.news.xs4all.nl> <u8mlfa51dojg3sfeicl0q6oi2g0ul0dgfr@4ax.com> <cm0c9pFisbdU1@mid.individual.net> <j2e4gah7bc587vb2pdjpfn9sa9ipujke61@4ax.com>
Mime-Version	1.0
Content-Type	text/plain; charset=utf-8
Content-Transfer-Encoding	8bit
X-Trace	solani.org 1426211631 2130 eJwNycEBwCAIA8CVEEnQcSg0+4/Q3vewudgZBAOCgm1Rg5IvXj6Z90gvPLdPTFuiKkPW+mvOBxk6ERg= (13 Mar 2015 01:53:51 GMT)
X-Complaints-To	abuse@news.solani.org
NNTP-Posting-Date	Fri, 13 Mar 2015 01:53:51 +0000 (UTC)
User-Agent	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0
X-User-ID	eJwFwQERADEIAzBLcNCWyWF78C/hEwSdT0kwsViiUt8pmzE9uYe0axeXPaNmDV0+pzeF4A8QdxC+
In-Reply-To	<j2e4gah7bc587vb2pdjpfn9sa9ipujke61@4ax.com>
Cancel-Lock	sha1:YxSneb6RFPemHGzUJt00ZVvHbqo=
X-NNTP-Posting-Host	eJwFwYEBACAEBMCVCE/j5Mv+I3QXBgXTEfCYGJUo7mUHcoh65+Yje6sM7023NTnTgtodLP0k4RGV
Xref	csiph.com comp.lang.php:15104

Show key headers only | View raw

jorn@jorna.dk word:

> On Sat, 07 Mar 2015 14:21:15 +0100, "J.O. Aho" <user@example.net>
> wrote:
> <snip>
>>> And *never* save passwords in clear text in a database.
>>> User passwords should *always* be hashed!
>>
>> Hashing ain't enough, you need to salt it too, speacially if using weak 
>> hashing like sha1.
> 
> That is true in many (most) cases. And since it’s very easy to do with
> newer PHP versions (5.5+), no doubt it’s best practice.

ACK.

> However, since there is no such thing as “absolute security”, the
> difference between no hashing and weak hashing like sha1 (or even md5)
> is much bigger than the difference between weak hashing and a good
> salted hashing.

IMO, hashing unsalted passwords with md5 is only marginally better than
storing the passwords directly[1], but you're still having all the
disadvantages of having hashed passwords.  At the very least put a
little salt in--better strech the hashes additionally.  And of course,
don't reinvent the wheel--use a library developed by experts.

[1] <https://www.google.com/#q=ec34ab51842c0c4dd543d6eb04894c23>

-- 
Christoph M. Becker

Thread

session management mrr <mireero@free.fr> - 2015-03-05 08:51 +0100
  Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 11:54 +0100
    Re: session management mrr <mireero@free.fr> - 2015-03-05 13:59 +0100
      Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-05 14:18 +0100
        Thank all! Re: session management mrr <mireero@free.fr> - 2015-03-06 13:47 +0100
          Re: Thank all! Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 08:53 +0100
        Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-07 11:59 +0100
          Re: session management "J.O. Aho" <user@example.net> - 2015-03-07 14:21 +0100
            Re: session management mrr <mireero@free.fr> - 2015-03-11 22:23 +0100
              Re: session management Jerry Stuckle <jstucklex@attglobal.net> - 2015-03-11 16:40 -0400
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-11 21:59 +0100
                Re: session management mrr <mireero@free.fr> - 2015-03-13 01:05 +0100
            Re: session management Jørn Andersen <jorn@jorna.dk> - 2015-03-13 02:37 +0100
              Re: session management "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-03-13 02:54 +0100
          Re: session management Richard Damon <Richard@Damon-Family.org> - 2015-03-07 11:29 -0500
          Re: session management Erwin Moller <erwinmollerusenet@xs4all.nl> - 2015-03-09 11:29 +0100
      Re: session management "J.O. Aho" <user@example.net> - 2015-03-05 18:22 +0100
    Re: session management Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-03-06 11:33 +0100
  Re: session management Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-03-05 11:55 +0000

csiph-web