Secure unsubscribe link - How much encryption is enough?
问题 My users can subscribe to threads that send them an email with a simple unsubscribe link. This link contains an encrypted subscribeid and a verifying userid via this process: // generate iv and create encrypted data $iv = openssl_random_pseudo_bytes(16); $encrypted = openssl_encrypt($data, 'AES-128-CBC', ENCRYPTION_KEY,0,$iv); // send the iv along with the encrypted text $ciphertext = $iv . $encrypted; // generate a hash which can verify the data has not changed $hash = hash_hmac('sha1',