Yes, I know. It is a comment in there that it is still on the TODO list to use SecureRandom.

But I want to know, exactly how am I violating the coding style?

Note that it would be nice if you also support PHP 5.5 native function password_hash if available (see https://gist.github.com/3707231). You should probably enforce PASSWORD_BCRYPT instead of PASSWORD_DEFAULT to be sure that you use bcrypt though (it might change in later versions of PHP).

@stof are we going to use this pull request?
I thought it was the one that @elnur made that was going to be used. Elnurs pull request

hmm, this PR is indeed not build on top of @elnur's PR but on top of an outdated version of @elnur's PR

Let's not spread the effort. I'm taking your suggestions to my PR into account when I think they are reasonable, and working on it when I have time. If you won't agree with my PR when it's gone final and merged, you can open another PR with fixes.

Well, it was the most up to date version of @elnur's PR at the time when I wrote it.

@elnur I opened a new PR on the main symfony/symfony branch by a mistake. It was because it somehow was impossible to make the pull request aginst the elnur/symfony branch. So yes, everyone but @elnur should ignore this pull request.