Password Compat

Compatibility with the password_* functions that ship with PHP 5.5 (by ircmaxell)
Add to my DEV experience #Passwords
Source Code
Suggest alternative
Edit details
Learn any GitHub repo in 59 seconds
Onboard AI learns any GitHub repo in minutes and lets you chat with it to locate functionality, understand different parts, and generate new code. Use it for free at www.getonboard.dev.
getonboard.dev
Sponsored

Password Compat Alternatives

Similar projects and alternatives to Password Compat

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a better Password Compat alternative or higher similarity.
Suggest an alternative to Password Compat

Password Compat reviews and mentions

Posts with mentions or reviews of Password Compat. We have used some of these posts to build our list of alternatives and similar projects. The last one was on 2023-02-25.
  • WordPlate: WordPress on Composer with sensible defaults
    9 projects | news.ycombinator.com | 25 Feb 2023
    > Same for WordPress.

    Not as much - WP favours backwards compatibility (or is it laziness?) even when doing so impacts security.

    Another problem is that the environments Wordpress targets are inherently vulnerable - while it's not WP's fault directly, they do nothing to warn people against using them nor outright stop supporting broken, insecure configurations.

    > There are multitudes of comments that specifically single out WP in the post's comment thread. Including this very thread that you are on.

    I was talking about publicized data breaches in general. But if we specifically talk about CMSes, I'm not sure anything else beats Wordpress and similar PHP-based CMSes of that era when it comes to not just the amount of vulnerabilities, but especially the nature of them - the same, dumb, basic problems resolved in every other language (including modern PHP with a framework such as Laravel) repeated over and over again.

    > WHERE is that objective study that compares WordPress with other software in regard to vulnerabilities

    Someone posted the following excerpt of the Wordpress codebase, which appears to be some custom attempt at simulating SQL query parameterization instead of using the actual, database-driver-provided function. If this is indeed the purpose of that function and it is indeed used, then I'm not sure there is any valid excuse for this in today's day and age.

    Someone else mentioned password hashing still relying on MD5 - if that is actually true, I'm not sure that is excusable either? I haven't done PHP for many years now, but surely even if the native functions aren't available, couldn't they use a "polyfill" such as https://github.com/ircmaxell/password_compat ?

    I'm sure there are many other issues but frankly the first one should be enough for any competent developer to run away.

    > No it doesnt. Dont make up falsities. PHP executes files how you configure it to.

    I was with you until this, but now I think you're arguing in bad faith.

    Yes, if you want to be pedantic, PHP and your web server execute files like how you configure them to. In practice, the environment where the vast majority of Wordpress sites are deployed (your typical shared hosting environment) will execute anything that ends with .php and is in the web root.

    This is inherently a legacy PHP problem (which WP encourages by supporting it) - no other language that I know of does this by default. If I accidentally store a malicious file in Python, Ruby, Node.js, etc applications, the worst that will happen is that I serve it back. At no point what so ever the server itself will execute that file.

    Yet in the PHP environments Wordpress targets, this is a massive issue which means every single feature handling file uploads (both in WP core and any plugins) should anticipate your server's misconfiguration (maybe it's not limited to .php files, but .html files too?) and try to protect against it, eventually failing and then you get yet another Wordpress vulnerability.

Stats

Basic Password Compat repo stats
1
2,156
0.0
almost 4 years ago

ircmaxell/password_compat is an open source project licensed under MIT License which is an OSI approved license.

The primary programming language of Password Compat is PHP.

Popular Comparisons

  1. Password Compat VS weakpass
  2. Password Compat VS Zxcvbn PHP
  3. Password Compat VS PHP Password Lib
  4. Password Compat VS Password Policy
  5. Password Compat VS phpass
  6. Password Compat VS Password-Generator
  7. Password Compat VS GenPhrase
  8. Password Compat VS Password Validator
  9. Password Compat VS hashtopolis
  10. Password Compat VS wordplate

Sponsored
Collect and Analyze Billions of Data Points in Real Time
Manage all types of time series data in a single, purpose-built database. Run at any scale in any environment in the cloud, on-premises, or at the edge.
www.influxdata.com