{"action":"closed","issue":{"url":"https://api.github.com/repos/magento/magento2/issues/992","repository_url":"https://api.github.com/repos/magento/magento2","labels_url":"https://api.github.com/repos/magento/magento2/issues/992/labels{/name}","comments_url":"https://api.github.com/repos/magento/magento2/issues/992/comments","events_url":"https://api.github.com/repos/magento/magento2/issues/992/events","html_url":"https://github.com/magento/magento2/issues/992","id":55019198,"number":992,"title":"Use native PHP Password API","user":{"login":"airbone42","id":1398594,"avatar_url":"https://avatars.githubusercontent.com/u/1398594?v=3","gravatar_id":"","url":"https://api.github.com/users/airbone42","html_url":"https://github.com/airbone42","followers_url":"https://api.github.com/users/airbone42/followers","following_url":"https://api.github.com/users/airbone42/following{/other_user}","gists_url":"https://api.github.com/users/airbone42/gists{/gist_id}","starred_url":"https://api.github.com/users/airbone42/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/airbone42/subscriptions","organizations_url":"https://api.github.com/users/airbone42/orgs","repos_url":"https://api.github.com/users/airbone42/repos","events_url":"https://api.github.com/users/airbone42/events{/privacy}","received_events_url":"https://api.github.com/users/airbone42/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/magento/magento2/labels/acknowledged","name":"acknowledged","color":"02d7e1"},{"url":"https://api.github.com/repos/magento/magento2/labels/improvement","name":"improvement","color":"d93f0b"},{"url":"https://api.github.com/repos/magento/magento2/labels/moved_to_forums","name":"moved_to_forums","color":"e99695"},{"url":"https://api.github.com/repos/magento/magento2/labels/TECH","name":"TECH","color":"d4c5f9"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":27,"created_at":"2015-01-21T13:38:41Z","updated_at":"2016-08-30T19:35:41Z","closed_at":"2016-08-30T19:35:41Z","body":"PHP 5.5 introduced a new password API natively to PHP. http://php.net/manual/en/book.password.php\r\n\r\nAs using BCRYPT for the default hashing algorithm it's not only more secure than the current implementaiton of md5 and sha256. But will even be automatically maintained with newer PHP versions and does not depend on any maintenance or upgrades by Magento.\r\n\r\nSo my suggestion is to replace the current hashing implementation in the Encryptor with using native password_hash and password_verify. Especially for an e-commerce system security should have a very high priority.\r\n\r\nSo rumors tell that Magento 2 will soon raise min. requirements to PHP 5.5, so that would be the best point to integrate this. Anyway if that min. version update might not come there's also a backward compatibility library available at https://github.com/ircmaxell/password_compat which could be used for PHP <5.5.\r\n\r\nIf Magento needs MD5 and SHA256 for b/c to Magento 1 hashes, I would suggest to move that into a separate module, so new Magento 2 shops without old data don't need to bother about this old hasing algorithms and the code coming with it. Even shops with older Magento 1 data could remove that b/c module after all customers have updated their password over time or by enforcing them after the first login. This reduces amount of code and complexity, buy having these Mage1 b/c modules and migrations optional.\r\n\r\nAnyway, would Magento be interested in porting the Encryptor into that way? If it will get accepted I would definitely dig into this and try to create a PR to speed up development."}}
{"actor":{"display_login":"piotrekkaminski"}}