Tagged Questions
1
vote
2answers
470 views
should i use urandom or openssl_random_pseudo_bytes?
I am developing a site in php 5.4 and i was wondering which is better to use to gen a random salt for password security?
$salt = sha1(openssl_random_pseudo_bytes(23));
or
$seed = '';
$a = ...
3
votes
3answers
225 views
PRNG: Does combining insecure algos help?
Reading about how insecure PHP's rand function is, I was wondering if it helps to combine random functions. The suggested function there, openssl_random_pseudo_bytes, can also be cryptographically ...
3
votes
3answers
1k views
How insecure are PHP's rand functions?
There are some pseudo-random-number generators in PHP: rand(), srand(), mt_rand(), mt_srand(). You can look at their code here.
I understand those functions are insecure, but how insecure are they?
...
16
votes
5answers
402 views
Hashed password storage with random salt
Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
6
votes
2answers
136 views
What to consider when generating random code as part of two-factor authentication?
I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
3
votes
2answers
562 views
Is this algorithm for a random string cryptographically secure?
I've pieced together this algorithm (if it can be called that) from various bits of code I've seen online, and I'm wondering how cryptographically secure it is. It's used to generate passwords:
...
