On Sun, Feb 2, 2014 at 2:50 PM, Rouven Weßling <[email protected]> wrote:
> as I've received no further feedback I've opened the voting on "Timing attack
> safe string comparison function":
>
> - https://wiki.php.net/rfc/timing_attack
>
> Voting ends on 2014/02/09 11:00PM UTC
>
Voted yes, but IMO the comparison function should behave a little more
like ===. That is: something like hash_compare(null,"") should return
false. Possibly be even more strict and require both input parameters
to be string (e.g. hash_compare(123,123) would return false as well).
But there's some "non-PHP"ish about that idea so I'm not horribly fussed by it.
-Sara