Prestashop加密纯文本密码

Question

From the plain text password what are steps to do before to add it inside the database.

Because of the blank schema ask for passwd (=hash) and secure_key, how I can get this information with php and Prestashop API ?

I'm using Prestashop 1.7.1

Thanks !

Answer 1

Iterate over an HMAC with a random salt for about a 100ms duration and save the salt with the hash. Use a function such as PBKDF2, Rfc2898DeriveBytes, password_hash, Bcrypt or similar functions. The point is to make the attacker spend a lot of time finding passwords by brute force.

For PHP use php Password Hashing Functions password_hash and password_verify.