{"action":"created","issue":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/9880","labels_url":"https://api.github.com/repos/yiisoft/yii2/issues/9880/labels{/name}","comments_url":"https://api.github.com/repos/yiisoft/yii2/issues/9880/comments","events_url":"https://api.github.com/repos/yiisoft/yii2/issues/9880/events","html_url":"https://github.com/yiisoft/yii2/issues/9880","id":110807062,"number":9880,"title":"\\base\\Security should use PHP's password_hash() by default","user":{"login":"tom--","id":1178722,"avatar_url":"https://avatars.githubusercontent.com/u/1178722?v=3","gravatar_id":"","url":"https://api.github.com/users/tom--","html_url":"https://github.com/tom--","followers_url":"https://api.github.com/users/tom--/followers","following_url":"https://api.github.com/users/tom--/following{/other_user}","gists_url":"https://api.github.com/users/tom--/gists{/gist_id}","starred_url":"https://api.github.com/users/tom--/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tom--/subscriptions","organizations_url":"https://api.github.com/users/tom--/orgs","repos_url":"https://api.github.com/users/tom--/repos","events_url":"https://api.github.com/users/tom--/events{/privacy}","received_events_url":"https://api.github.com/users/tom--/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/yiisoft/yii2/labels/severty:security","name":"severty:security","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"samdark","id":47294,"avatar_url":"https://avatars.githubusercontent.com/u/47294?v=3","gravatar_id":"","url":"https://api.github.com/users/samdark","html_url":"https://github.com/samdark","followers_url":"https://api.github.com/users/samdark/followers","following_url":"https://api.github.com/users/samdark/following{/other_user}","gists_url":"https://api.github.com/users/samdark/gists{/gist_id}","starred_url":"https://api.github.com/users/samdark/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/samdark/subscriptions","organizations_url":"https://api.github.com/users/samdark/orgs","repos_url":"https://api.github.com/users/samdark/repos","events_url":"https://api.github.com/users/samdark/events{/privacy}","received_events_url":"https://api.github.com/users/samdark/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/yiisoft/yii2/milestones/14","html_url":"https://github.com/yiisoft/yii2/milestones/2.0.7","labels_url":"https://api.github.com/repos/yiisoft/yii2/milestones/14/labels","id":1107394,"number":14,"title":"2.0.7","description":"","creator":{"login":"cebe","id":189796,"avatar_url":"https://avatars.githubusercontent.com/u/189796?v=3","gravatar_id":"","url":"https://api.github.com/users/cebe","html_url":"https://github.com/cebe","followers_url":"https://api.github.com/users/cebe/followers","following_url":"https://api.github.com/users/cebe/following{/other_user}","gists_url":"https://api.github.com/users/cebe/gists{/gist_id}","starred_url":"https://api.github.com/users/cebe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cebe/subscriptions","organizations_url":"https://api.github.com/users/cebe/orgs","repos_url":"https://api.github.com/users/cebe/repos","events_url":"https://api.github.com/users/cebe/events{/privacy}","received_events_url":"https://api.github.com/users/cebe/received_events","type":"User","site_admin":false},"open_issues":97,"closed_issues":78,"state":"open","created_at":"2015-05-12T19:21:21Z","updated_at":"2015-10-10T17:45:54Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-10-10T17:28:37Z","updated_at":"2015-10-10T17:52:17Z","closed_at":null,"body":"password_hash() was introduced in PHP 5.5 and today I think the way Security::generatePasswordHash() and validatePassword() choose between that and using crypt() is silly. Better to simply prefer password_hash() when available and avoid the confusing $passwordHashStrategy config variable. Moreover, using crypt() is the default strategy at present.\r\n\r\nOptions\r\n\r\n1. Change algorithms to use password_hash() when available and remove $passwordHashStrategy → Breaks BC.\r\n2. Change algos, leave $passwordHashStrategy alone but ignore it → works, is BC, but unsavory, perhaps even dishonest.\r\n3. Like option 2 but throw an exception with a specific message when an app sets $passwordHashStrategy → is BC but how exactly to implement?\r\n4. Introduce a third value $passwordHashStrategy = 'default', as new default, and this strategy prefers password_hash() when available over crypt() → BC\r\n\r\nI think option 1 is a possibility for Yii 2.1. Options 3 and 4 could be done now."},"comment":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/comments/147112542","html_url":"https://github.com/yiisoft/yii2/issues/9880#issuecomment-147112542","issue_url":"https://api.github.com/repos/yiisoft/yii2/issues/9880","id":147112542,"user":{"login":"samdark","id":47294,"avatar_url":"https://avatars.githubusercontent.com/u/47294?v=3","gravatar_id":"","url":"https://api.github.com/users/samdark","html_url":"https://github.com/samdark","followers_url":"https://api.github.com/users/samdark/followers","following_url":"https://api.github.com/users/samdark/following{/other_user}","gists_url":"https://api.github.com/users/samdark/gists{/gist_id}","starred_url":"https://api.github.com/users/samdark/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/samdark/subscriptions","organizations_url":"https://api.github.com/users/samdark/orgs","repos_url":"https://api.github.com/users/samdark/repos","events_url":"https://api.github.com/users/samdark/events{/privacy}","received_events_url":"https://api.github.com/users/samdark/received_events","type":"User","site_admin":false},"created_at":"2015-10-10T17:52:17Z","updated_at":"2015-10-10T17:52:17Z","body":"`3.` Could be done via check in init."}}