Password Hashing in PHP

An unconference talk that I gave at the PHP North West 2012 conference.

It explores the ways that password hashes are attacked, and how those attacks can be prevented. It also goes into some tools that are available to properly hash passwords for storage in PHP. We introduce the new Password Hashing API that will be available in PHP 5.5...

Slides: http://ircmaxell.github.com/password-...

References:
PHP 5.5 Password Hashing: https://wiki.php.net/rfc/password_hash
Password Compat: https://github.com/ircmaxell/password...
PasswordLib: https://github.com/ircmaxell/PHP-Pass...
PHPASS: http://www.openwall.com/phpass/

Tools:
John The Ripper: http://www.openwall.com/john/
HashCat: http://hashcat.net/

• Category

  Science & Technology

[Anthony Ferrara]

FYI: the bcrypt crack that was shown in the demo finally finished. In a grand total of 15 days 9 hours 24 minutes. To crack what MD5 cracked in 15 seconds... :-D

[brandonb927]

Awesome video! Going to be showing a portion of this in a presentation to some university students as an alumni

[Henry Rafeh]

wow i didnt understand shit so confusing nube to this

[Aaron Fisher]

Why is this still a thing, just because you use a Mac or Windows or whatever you use does not change your ability.

[Wesley Murch]

I've always called it "PH Pass" (as in PASSword), but I there's something I like about about the way you say "PHP Ass".

[gamer9774]

mac user? * immediately clicks back button*

[Kparris7]

Thanks for the video man!

[Thomas Maurstad Larsson]

Awesome talk.

[Bruno Cassol]

Awesome! Thank you for sharing!