- Is
wp_generate_password()as safe as the salts generated by the recommendedhttps://api.wordpress.org/secret-key/1.1/salt/?
Those details can’t be answered as for obvious reasons, the internals are unknown by the public. If we could answer that, then details would be known that allow for reverse engineering the process. This could lead to a decrease of security. Note, that someone could still try to set a gazillion of requests to this Url and then try to reverse engineer the process from watching what bubbles to the surface.
- Is there any downgrade in security by having the salts in the database as this method falls back to that?
Yes. You do not want to have security details/authentication credentials saved anywhere where it might be accessible by others. This includes:
- Version control
- Command line history
- Database or file backups
- …
Either keep your authentication credentials and related data (like for e.g. “salt”) in .env files (see Dotenv package), in your deployment services secret secure haven, in separate configuration files (for e.g. AWS credentials file) and therefore in only a single location.
- Does it have any security implications to not set the values and let them be generated randomly on the fly
to the db?
Yes. As auth constants are used in Cookies as well, you would invalidate your users log in sessions by invalidating your users Cookies. Those are constants for a reason: They should stick and do not change per request.
Edit: As @gmazzap pointed me to it, I was not talking about values saved to the database, but about “generated on the fly” constants. In case you save it to the database, please refer to point 2 regarding security.
For further additions, please follow the link from @Mark Kaplun and read @gmazzap answer in detail (and upvote both).
Additional Note/Reminder: Always add some own pseudo random characters to the retrieved data from the API servers. And never ever give your credentials or your database out of hands. You won’t believe what people tend to email, save on usb-sticks, their private dropbox accounts or on hard disks on laptops without password…
Edit: As @stephenharris pointed out in [chat], there’s an interesting blog post around that topic that goes in far more detail than our answers here.