2

http://php.net/manual/en/function.password-hash.php

Is that less secured ?

echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT);
=> $2y$12$QjSH496pcT5CEbzjD/vtVeH03tfHKFy36d4J0Ltp3lRtee9HDxY3K

And with extra cost:

$options = [
    'cost' => 12,
];
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options);

=>$2y$12$QjSH496pcT5CEbzjD/vtVeH03tfHKFy36d4J0Ltp3lRtee9HDxY3K

Is that "too predictable" ?

Extra question : if an encrypted password above is exposed, how long is would take to "crack" one ? Given that the hackers have dozen of good computers which only took few hours to crack our admin password in sha256 without knowing the salt.

Disclaimer : I first read about encryption 13 years ago but my brain CPU was never able to fully process those concepts, too much math. Now my boss assign me the task, so I guess asking simple question may help me a little.

  • Remember, passwords are not encrypted, but hashed. – multithr3at3d Jun 20 '18 at 16:22
  • 1
    @multithr3at3d : ppl keep saying that but I don't understand. I guess I need to read even more. I will be back , lol. Update: I get it now, hash = one way, encrypt = reversible. – Phung D. An Jun 20 '18 at 16:25
6

It is not less secure because in absence of a manually provided salt, a securely generated salt is automatically created and used. So, the option of providing your own, while it could be as secure, would never be more secure, and could very easily be (and probably often was) less secure if salt generation technique was poor.

If it meant that no salt as all were used, that indeed would be less secure, but thankfully that is not the case...You're just getting a more secure default configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.