Deprecate random_string basic/md5/sha1

Is anyone using the following types of random_string()?

basic: A random number based on mt_rand() (length ignored).
md5: An encrypted random number based on md5() (fixed length of 32).
sha1: An encrypted random number based on sha1() (fixed length of 40).
https://codeigniter4.github.io/CodeIgnit...dom_string

As you know, these values are cryptographically insecure.
I personally do not understand the use case.
I suggest that they be deprecated.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

No, I quit using them a while back because like you say they are insecure.

What did you Try? What did you Get? What did you Expect?

Joined CodeIgniter Community 2009.  ( Skype: insitfx )

I use "crypto" and "alnum" for generate tokens string. Just random string (w/o security context)

crypto is secure. alnum is not secure now, but I'm going to make it secure.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

In the past i've used this for generating hash to compare with payments.
Now using the hash_hmac() and hash_equals() for that, so the above is not being used by me anymore.

+1 for alnum, but we are migrating towards ULID

+1 for alnum, but we are migrating towards ULID

What do you mean by +1 for alnum?

My proposal is to make basic/md5/sha1 deprecated.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper

+1 for alnum, but we are migrating towards ULID

What do you mean by +1 for alnum?

My proposal is to make basic/md5/sha1 deprecated.

OK, I quickly read it as deprecating random_string().

It is important to note that using the basic, md5, and sha1 methods of random_string() may not be secure as they are not cryptographically secure.

While there may be some use cases for these methods, it is recommended to use more secure methods for generating random strings, such as the OpenSSL library.

Considering the potential security risks associated with using these methods, it may be a good idea to deprecate them and encourage the use of more secure options.

Updated the docs:
https://codeigniter4.github.io/CodeIgnit...dom_string

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper