Details
-
Bug
-
Resolution: Fixed
-
Minor
-
2.9.3, 3.0
-
MOODLE_29_STABLE, MOODLE_30_STABLE
-
MOODLE_29_STABLE, MOODLE_30_STABLE
-
MDL-52283-master -
Description
See https://github.com/tpunt/PHP7-Reference#deprecation-of-salt-option-for-password_hash
With the introduction of the new password hashing API in PHP 5.5, many began implementing it and generating their own salts. Unfortunately, many of these salts were generated from cryptographically insecure functions like mt_rand(), making the salt far weaker than what would have been generated by default. (Yes, a salt is always used when hashing passwords with this new API!) The option to generate salts have therefore been deprecated to prevent developers from creating insecure salts.