-
-
Notifications
You must be signed in to change notification settings - Fork 136
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Slimming down the lib further #121
Comments
This is a leftover from the PHP5 era |
while you're at it, might be worth cleaning up all the unreachable code in |
@willpower232 done, good spot! When I'm done with this lib it'll be a 3 lines function :p |
wait till they announce it as a native library or something haha |
* remove insecure rng providers and remove the openssl provider. We now rely exclusively on random_bytes(), as there are no reasons not to. Fix #121 * remove the isSecure property of the test rng class * remove pointless test rng class we were testing a test class, which didn't make a lot of sense. * Revert "remove pointless test rng class" This reverts commit f6da6be. * Reapply "remove pointless test rng class" This reverts commit 06220d4. * assing rng provider to class attribute this also aligns with other providers * remove polyfill for hash_equals
So I was looking at:
TwoFactorAuth/lib/TwoFactorAuth.php
Lines 175 to 189 in 086a375
And I wondered: in which case would anyone use something other than PHP's own
random_bytes()
function?Before hacking away at the code, I wanted to open an issue to discuss it. IMHO, the openssl_random_pseudo_bytes can go away, along with the
hash
one, which should definitely go as it's not cryptographically secure.Let's rely on the good work done by PHP devs to give us this CSPRNG function, while still leaving the door open for anyone to provide their own, of course, no need to lock it down. But no need to support anything else than the gold standard, don't you think?
TwoFactorAuth being a security related library, making the code smaller leaves less chances for bugs, and alleviates the maintenance, too!
The text was updated successfully, but these errors were encountered: