7 Fixed grammar and formatting.
source | link

Well thisThis question has received a lot of hits, more thenthan I ever thought it would have on such a basic topic. So, I thought I would update people on what I am doing. Also I keep reading in the comments that I am storing PW'spasswords as plaintextplain text. Just to clarify I am not.

eachEach time it returns FALSE, I always tell them the entire password need.

Well forFor PHP, I am using the best there is for this language. I am using this library which is the PHP 5.5 equivalence of the new password hashing API created by Anthony Ferrara. My reasoning for this hashing use is simple, very high demand on the CPU (if you ever test it out on a linux Linux/ windowsWindows box CPU usage is at 100%). Also, the algorithm is very scalable due to the cost factor the higher the cost the more grueling the task is for the CPU to log a person in. Last I "Tested", I put the cost to 24. An entire hour passed for me to try and login and I got a PHP time out error before I even got past the login screen. (this was a foolish cost factor btw). A study done by Jeremi Gosney (THIS IS THE PDF DOWNLOAD OF THE REPORT) which tested the strength of this function compared to other more popular ones (yes, more popular -_-) concluded that even with 25 - GPU'sGPUs, while using bcrypt at a cost of 5, password hashing is the last of your concerns. I use a cost of 17...

Well this question has received a lot of hits, more then I ever thought it would have on such a basic topic. So I thought I would update people on what I am doing. Also I keep reading in the comments that I am storing PW's as plaintext. Just to clarify I am not.

each time it returns FALSE I always tell them the entire password need.

Well for PHP I am using the best there is for this language. I am using this library which is the PHP 5.5 equivalence of the new password hashing API created by Anthony Ferrara. My reasoning for this hashing use is simple, very high demand on the CPU (if you ever test it out on a linux / windows box CPU usage is at 100%). Also the algorithm is very scalable due to the cost factor the higher the cost the more grueling the task is for the CPU to log a person in. Last I "Tested", I put the cost to 24. An entire hour passed for me to try and login and I got a PHP time out error before I even got past the login screen. (this was a foolish cost factor btw). A study done by Jeremi Gosney (THIS IS THE PDF DOWNLOAD OF THE REPORT) which tested the strength of this function compared to other more popular ones (yes more popular -_-) concluded that even with 25 - GPU's, while using bcrypt at a cost of 5, password hashing is the last of your concerns. I use a cost of 17...

This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I thought I would update people on what I am doing. Also I keep reading in the comments that I am storing passwords as plain text. Just to clarify I am not.

Each time it returns FALSE, I always tell them the entire password need.

For PHP, I am using the best there is for this language. I am using this library which is the PHP 5.5 equivalence of the new password hashing API created by Anthony Ferrara. My reasoning for this hashing use is simple, very high demand on the CPU (if you ever test it out on a Linux/Windows box CPU usage is at 100%). Also, the algorithm is very scalable due to the cost factor the higher the cost the more grueling the task is for the CPU to log a person in. Last I "Tested", I put the cost to 24. An entire hour passed for me to try and login and I got a PHP time out error before I even got past the login screen (this was a foolish cost factor). A study done by Jeremi Gosney (THIS IS THE PDF DOWNLOAD OF THE REPORT) which tested the strength of this function compared to other more popular ones (yes, more popular) concluded that even with 25 - GPUs, while using bcrypt at a cost of 5, password hashing is the last of your concerns. I use a cost of 17...

6 edited tags
| link
5 added 430 characters in body
source | link

Well for PHP I am using the best there is for this language. I am using this library which is the PHP 5.5 equivalence of the new password hashing API created by Anthony Ferrara. Its very demandingMy reasoning for this hashing use is simple, very high demand on the CPU (if you ever test it out on a linux / windows box CPU usage is at 100%). It hasAlso the algorithm is very good scalingscalable due to the cost factor the higher the cost the more grueling the task is for the CPU to log a person in. Last I "Tested", I put the cost to 24. An entire hour passed for me to try and login and I got a PHP time out error before I even got past the login screen. (this was a foolish cost factor btw). A study done by Jeremi Gosney (THIS IS THE PDF DOWNLOAD OF THE REPORT) which tested the strength of this function compared to other more popular ones (yes more popular -_-) concluded that even with 25 - GPU's, while using bcrypt at a cost of 5, password hashing is the last of your concerns. I use a cost of 17...

public function create_user($value) {
        $this -> CI = get_instance();
        $this -> CI -> load -> library('bcrypt');

        foreach ($value as $k => $v) {// add PDO place holder to the keys
            $vals[":$k"] = $v;
        }
        $vals[":password"] = $this -> CI -> bcrypt -> password_hash($vals[":password"], PASSWORD_BCRYPT, array("cost" => 17)); // Take old $vals[":password"] and run it through bcrypt to come up with the new $vals[":password"] 

Well for PHP I am using the best there is for this language. I am using this library which is the PHP 5.5 equivalence of the new password hashing API created by Anthony Ferrara. Its very demanding for a CPU. It has very good scaling. A study done by Jeremi Gosney (THIS IS THE PDF DOWNLOAD OF THE REPORT) which tested the strength of this function compared to other more popular ones (yes more popular -_-) concluded that even with 25 - GPU's, while using bcrypt at a cost of 5, password hashing is the last of your concerns. I use a cost of 17...

public function create_user($value) {
        $this -> CI = get_instance();
        $this -> CI -> load -> library('bcrypt');

        foreach ($value as $k => $v) {// add PDO place holder to the keys
            $vals[":$k"] = $v;
        }
        $vals[":password"] = $this -> CI -> bcrypt -> password_hash($vals[":password"], PASSWORD_BCRYPT, array("cost" => 17)); 

Well for PHP I am using the best there is for this language. I am using this library which is the PHP 5.5 equivalence of the new password hashing API created by Anthony Ferrara. My reasoning for this hashing use is simple, very high demand on the CPU (if you ever test it out on a linux / windows box CPU usage is at 100%). Also the algorithm is very scalable due to the cost factor the higher the cost the more grueling the task is for the CPU to log a person in. Last I "Tested", I put the cost to 24. An entire hour passed for me to try and login and I got a PHP time out error before I even got past the login screen. (this was a foolish cost factor btw). A study done by Jeremi Gosney (THIS IS THE PDF DOWNLOAD OF THE REPORT) which tested the strength of this function compared to other more popular ones (yes more popular -_-) concluded that even with 25 - GPU's, while using bcrypt at a cost of 5, password hashing is the last of your concerns. I use a cost of 17...

public function create_user($value) {
        $this -> CI = get_instance();
        $this -> CI -> load -> library('bcrypt');

        foreach ($value as $k => $v) {// add PDO place holder to the keys
            $vals[":$k"] = $v;
        }
        $vals[":password"] = $this -> CI -> bcrypt -> password_hash($vals[":password"], PASSWORD_BCRYPT, array("cost" => 17)); // Take old $vals[":password"] and run it through bcrypt to come up with the new $vals[":password"] 
4 added 4290 characters in body
source | link
3 I guess php is irrevelant to this question.
| link
    Question Protected by Adi
2 Grammar/spell, removed "Thanks"
source | link
    Tweeted twitter.com/#!/StackSecurity/status/367390610334171136
1
source | link