Slashdot Mirror
PHP Now Supports Argon2 Next-Generation Password Hashing Algorithm (bleepingcomputer.com)
An anonymous reader quotes Bleeping Computer: PHP got a whole lot more secure this week with the release of the 7.2 branch, a version that improves and modernizes the language's support for cryptography and password hashing algorithms.
Of all changes, the most significant is, by far, the support for Argon2, a password hashing algorithm developed in the early 2010s. Back in 2015, Argon2 beat 23 other algorithms to win the Password Hashing Competition, and is now in the midst of becoming a universally recognized Internet standard at the Internet Engineering Task Force (IETF), the reward for winning the contest. The algorithm is currently considered to be superior to Bcrypt, today's most widely used password hashing function, in terms of both security and cost-effectiveness, and is also slated to become a favorite among cryptocurrencies, as it can also handle proof-of-work operations.
The other major change in PHP 7.2 was the removal of the old Mcrypt cryptographic library from the PHP core and the addition of Libsodium, a more modern alternative.
Of all changes, the most significant is, by far, the support for Argon2, a password hashing algorithm developed in the early 2010s. Back in 2015, Argon2 beat 23 other algorithms to win the Password Hashing Competition, and is now in the midst of becoming a universally recognized Internet standard at the Internet Engineering Task Force (IETF), the reward for winning the contest. The algorithm is currently considered to be superior to Bcrypt, today's most widely used password hashing function, in terms of both security and cost-effectiveness, and is also slated to become a favorite among cryptocurrencies, as it can also handle proof-of-work operations.
The other major change in PHP 7.2 was the removal of the old Mcrypt cryptographic library from the PHP core and the addition of Libsodium, a more modern alternative.
I just got done converting everything to bcrypt!
gas gas gas
Who knew that PHP was still around?
So now all we have to worry about with PHP is everything else.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
I usually store passwords salted and hashed 100 to 500 thousand times with SHA-256 or MD5.
Should I switch to this now ?
Write boring code, not shiny code!
If I understand correctly, Argon2 is "memory hard" hashing. It takes a lot of memory to run efficiently in an effort to confound FPGAs and ASICs. How is this supposed to work in an embedded system such as IoT? Those devices are very tiny and might not have enough memory. Isn't delaying 1 second after a failed password attempt enough?
And this criticism still applies.
The name "argon" is derived from a Greek word, neuter singular form of another Greek word, meaning "lazy" or "inactive".
Yup. PHP dabblers to a T.
Author knows nothing about security. Updated crypto algorithms / libraries have next to nothing to do with application security.
How many apps are hacked through outdated crypto algorithms? Now how many are hacked through unchecked user input, careless key/password handling, privilege escalation, default passwords, sensitive files left in open locations, and other programming errors?
There's a reason OpenBSD is one of (if not the) most secure operating systems. Code audits, careful input / output checking, sane error handling, etc. It has nothing to do with crypto algorithms.
Democracy is two wolves and a sheep voting on lunch.
My hash algorithm, which I'll summarize here as taking the mod 42 remainder of the 42nd content byte (*), is computationally much faster than Argon2, although theirs is arguably more secure.
(*) if there are fewer than 42 bytes, the algorithm emits 42. Other details are described in my journal article
PHP got a whole lot more secure this week with the release of the 7.2 branch, a version that improves and modernizes the language's support for cryptography and password hashing algorithms.
Adding new cryptography and hashing methods doesn't make the language itself more secure.
systemd is Roko's Basilisk.
My own tests with Argon2 prove that with it's lowest setting it loads my current server down too much for the hash rate I was getting with bcrypt. I do not have the ability to fine tune it's server load well enough at this point so I've not switched over password hashing to it at this time. Also, I have less free RAM than I'd like to allocate so the benefits of argon2 are significantly limited for me at this time... It is going to be a trade off between server resources and massively parallel GPU attacks and the RAM use is primarily the new defense of Argon2 (not so much parallelism since that is still an area of growth for hardware.)
I've seen tests run with GPU hashing implementing a huge list of algorithms where bcrypt was 100x better than everything else and for the test it was only set to 5! Nobody uses bcrypt set at complexity 5! no benchmarks vs Argon2 other than my own (using server cpus.)
Somebody with bcrypt in FPGAs might knock the wind out of it but bcrypt at level 10+? Going forward, I've already been migrating to argon2 and I will look into formatting it into standard password hash format now that I know it's being used this way; however, I will still be limiting it until server upgrades... and further Argon2 benchmarks performed on gpus, fpgas because it won't matter if my server needs weaken Argon2 too much. (At which point I guess we need to start getting gpus for servers?)
Democracy Now! - uncensored, anti-establishment news
There was a mismatch between the specification and the example code/known answers.
Unless that's been fixed in the last few weeks anyone implementing Argon2 will get burned.
Thanks APK!
I am looking forward to our meeting on Wednesday to share revenue stream techniques.
--
cdreimer
https://slashdot.org/~cdreimer
The PHP crew doesn't hesitate for a second to add in a feature that's useful. PHP gets the job done and that's why it's still holding it's ground even after each and every rails and node fad that comes along.
We suffer more in our imagination than in reality. - Seneca
You might be retarded, APK. I went down your rabbit hole of links on links on links. You seem really pissed off at OrangeTide, but just about every link that was supposed to "point" to some "evidence" of whatever you are trying to illustrate are just links back to your own ramblings with links doing the same thing. It is a web of you arguing *something* with yourself, and a handful of ACs
The root post was Orangetide's saying I sound like a fool (git). I'm just exposing him for lying. Orangetide said I pick on him? Produce the evidence.
(Orangetide refuses to supply evidence I ever bothered him first or at all much less for years as he said clearly)
* Orangetide is lying and evading answering or supplying evidence of me ever bugging him in fact until now - NOW he has it coming.
(He's also downmod 'burying' my posts confronting him & doesn't seem to "get it" - I repost & no matter how many sockpuppet alternate accounts "his kind" has or 'idiot pals'? They'll NEVER be able to stop me exposing him - I HAVE NO POST LIMITS, they do have limits in modpoints - so TRY shit on me?? I'll fuck you over publicly! Then again shitheads behind FAKE NAMES have no class or honor - they're losers & they KNOW IT using fake names online!)
APK
P.S.=> Lastly - You can quit posting to "defend yourself" by AC posts OrangeTide, especially w/ that bullshit because THIS IS NOT GOING TO STOP as long as you keep running from it boy - you've already been CAUGHT doing that 'defending yoruself' by AC posts (big mistake that one, lol - classic & priceless in fact)... apk
Backup your bs w/ proof OrangeTide https://it.slashdot.org/comments.pl?sid=11425437&cid=55663429/ provide proof of me picking on you 'for years' as you said - you can't.
(If I had issues w/ you I'd have bookmarked it & I never have before YOU came in calling me a "git" (fool) starting hassles!)
* See you there (somehow I don't think I will & you will continue to embarass yourself as you did starting garbage with me - I am going to let YOU finish YOURSELF boy)
Additionally - CLASSIC & PRICELESS: I also CAUGHT YOU posting UNIDENTIFIABLE AC vs. using your registered 'lusername' yet you point to YOUR POSTthat was done under your REGISTERED 'lusrname' claiming it too (YOU = FLATOUT-BUSTED -> https://slashdot.org/comments.pl?sid=11432439&cid=55667787/ )
SEE YOU DOWNMOD HID THIS LAST 6x TIMES I POSTED IT TOO https://slashdot.org/comments.pl?sid=11430293&cid=55668641/ & https://slashdot.org/comments.pl?sid=11433711&cid=55669021/ + https://slashdot.org/comments.pl?sid=11432725&cid=55669055/ https://slashdot.org/comments.pl?sid=11432725&cid=55669519/ https://slashdot.org/comments.pl?sid=11430293&cid=55669493/ - weak trying to hide it!
APK
P.S.=> This is the 14th time you've done a "Run, Forrest: RUN!!!" vs. it OrangeTide - why's that? I caught you lying?? Cat got your tongue??? Yes, obviously - pitiful... apk
You might be retarded, APK...
Chris, everybody on /. knows you are the retarded!
APK
See subject: Take your POOR advice & your drugs/drink - Your advice is a fool's advice. Drugs/drink f you over!
Take shots @ me by telling lies like OrangeTide (a fake name for his fake life) did?
FINE - I give it back 10 fold! I won't have MY GOOD NAME crapped on by some douche that can't backup HIS bullshit, which he CLEARLY CAN'T! Especially by OrangeTide FAKE NAME for his FAKE LIFE bullshit. ... & apparently, he doesn't like it (neither did I being called names I am not & when he says I called him names & picked on him for YEARS, I merely ask he produce it as fact - HE CANNOT!).
* He's a liar & a smarmy little bitch avoiding the fact I have him pinned in SO BADLY via his own big mouth that started this fiasco, that he avoids replying producing proof of his bullshit lies (rightfully so - he KNOWS he is BUSTED lyingalbeit as AC post/b> (which I caught him doing before no less) but STILL won't backup his bullshit lie https://it.slashdot.org/comments.pl?sid=11425437&cid=55670111/
THAT IS PROOF HE KNOWS HE IS A NO GOOD LITTLE LIAR & that's good enough for me, as I can always toss this right at him for starting trouble & his BIG MOUTH writing CHECKS his lame fairy ass CAN'T CASH!
APK
P.S.=> I don't take shit from "soy boy" weasels - especially those out of FLIMSY WRIST land San Francisco areas - I don't know HOW you were raised OR where you are from but, where I am from? You pull that shit you get KNOCKED THE FUCK OUT (& that's all, IF You're lucky)... apk
" php is doddering around like an old man smelling of urine and fear."
I'm stealing that.
See subject: Now OrangeTide & his multiple sockpuppets i impersonate me & are out of downmodpoint they try bury this (go ahead, I'll just keep it up until he repents for his bullshit lies).
* You CHUMPS just DO NOT "GET IT", do you? I can post without LIMIT & you take shots @ me that tick me off (lies do)?? I'll make sure you RUE THE DAY YOU DID...
(Fake names - it's WHY you use them, like "OrangeTide" - you're shit, you know it. & YOUR MISERABLE LIVES show it!)
APK
P.S.=> Keep it up shitheads - doesn't make me cancel 1/2 a step even, I'll just keep coming (& there is NOTHING you can DO about it)...apk
Should be careful, asshole. Creimer and APK went down the rabbit hole over a year ago. It was an epic battle. The only reason they stopped is that the comment system wouldn't allow any more replies. If you go after APK, you're a dumb fuck. He will bury your little pussy.
and a lot more stuff ... Right Now !
Here is the link:
https://reactphp.org/
The NodeJS Fanboys are even worse than the iFanboys :)
Swoole:
https://www.swoole.co.uk/
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion
Comment removed based on user account deletion