New answers tagged

0

In your crypt alternative, you construct the salt using mt_rand. This is not recommended, because the cryptographic quality (i;e. it is not random enough) is not sufficient. This is explicitly documented: CAUTION: This function does not generate cryptographically secure values, and should not be used for cryptographic purposes. If you need a ...


10

It's unsafe because it exposes your password a number of different ways. Any user can see it in the output of programs like top and ps aux -www. They don't need to be root for to see your processes. It gets logged into your shell history, so if you do something foolish like chmod 777 ~, anybody and everybody can cat ~user/.history and view the password. ...



Top 50 recent answers are included