这是我第一次不得不处理人事信息，我想确保我有足够的安全性。我将在 MySQL 表上存储用户的电子邮件和他们帐户的密码，所以我想知道 password_hash() 函数是否足以进行散列。
例如，这是否是存储密码的可接受的安全量？：
$password = password_hash($password, PASSWORD_BCRYPT);
然后，当用户尝试登录以进行验证时，我会比较散列密码。此外，因为我不需要电子邮件用于联系目的，它们也可以被散列。
安全新手，php password_hash() 是否足够好？
信息安全
密码
哈希
php
2021-09-10 12:00:09
1个回答
Using bcrypt is a good start; that's the recommended choice (or at least one of the recommended choices). The documentation seems to indicate that PHP finally does things properly. Make sure that your PHP version is at least 5.5.0. Don't try to fiddle with salts: by default, the function will generate a random salt when needed, and that's the right way to do it, so just let it do its job.
You should try to alter the "cost" option as well. For bcrypt, the cost is a value ranging from 4 to 31; each increment means that the password hashing is twice as expensive, both for your server and for the attacker. In practice, you want to make that value as high as can be tolerated, given your server power, average load, peak load, and maximum user patience: this will give you the best security that you can hope for.
(Note that I said "the best", not "good".)
If you want to understand the underlying concepts for good password hashing, and why bcrypt is a good choice, start here.
其它你可能感兴趣的问题