I'm on a journey of learning everything about information security and as i've read about how to secure a password, i didn't quite understood why should i slow down the hashing of a password and how to do it properly.
Yes, it takes longer to crack it but eventually it will be cracked, even if it happen in years.
Also, it would be great if you can give me some advice on what to add to the below code to secure it more. I really want to make a password to be as secured as it can be.
$password = 'userinput';
$hash = password_hash($password, PASSWORD_DEFAULT);
After some research i understood that password_hash is the best way to do it, because it does all the job properly (salt, crypt algorithm), and the bcrypt(PASSWORD_DEFAULT) is ,for now, the safest to use.Also for storage of the password VARCHAR(255) is the recommended one.
I didn't quite understood what option['cost'] is for, except that it is also used to slow down the hashing.
Should i use a pepper? And how to embed it in the code? Should i store it in database, is it of use later? I've read this post but i couldn't figure out how to replicate it using password_hash as the code above.
Following this blog , if i'm using a pre-hash(pepper) altogether with pass hash, the hash can contain NULL-bytes which are devastating for security, so should i somehow sanitize the 'userinput' to remove the '\0' set of chars? or just do as he says:
- Use hex output from the pre-hash
- Base64 encode the raw output of a pre-hash
Please, if any of my statements/questions are wrong, correct me.
A code along with the explanation would be very helpful to me. This would help me a lot to better understand the password security.Thank you
UPDATE: After this question has been marked as duplicate, i found a quite informative post about why is it helpful to slow down hashing. But that was just a point of my entire question.
The 4 points are still unclear and unanswered and i couldn't find almost anything about them in that post.
One thing that i forgot to mention is that i'm coding in php, and would be helpful if the code example would be written in php. Also i don't think that this question is too broad as the topic of the post is simply password securing and not the entire information security. I've seen far more complex and broad questions here than mine.
