Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17099

Re: HTTPS data in a form

Show all headers | View raw

Stefan Froehlich wrote:

> On Tue, 20 Sep 2016 15:40:04 Thomas 'PointedEars' Lahn wrote:
>> Stefan Froehlich wrote:
>> > On Mon, 19 Sep 2016 23:28:27 Thomas 'PointedEars' Lahn wrote:
>> >> because the used encryption/hashing algorithm would have to reside
>> >> on the client in the form of a client-side script *for every
>> >> attacker plain to see* (obfuscation is _not_ protection).
>> > If you use asymmetric encryption this would not be the big problem.
>> Exposing the used encryption algorithm to a potential attacker is a
>> security leak.
> 
> No. Security by obscurity.

Utter nonsense.  It would only be “security by obscurity” if this was the 
only consideration, e.g. the hashing algorithm were weak and one would 
consider not telling about that to be the solution to the problem.

In general, telling an attacker anything about the used mechanisms makes it 
*easier for them to run an attack*.  So DO NOT do that.  *And do not stop 
there.*
 
>> It is a big problem in any case.
> 
> The problem in this case is somewhere else (as you and others did point
> out already)

There are several problems in this case, including this one.

-- 
PointedEars
Zend Certified PHP Engineer 
<http://www.zend.com/en/yellow-pages/ZEND024953> | Twitter: @PointedEars2
Please do not cc me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

HTTPS data in a form bit-naughty@hotmail.com - 2016-09-15 21:45 -0700
  Re: HTTPS data in a form "J.O. Aho" <user@example.net> - 2016-09-16 07:52 +0200
  Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-17 15:57 +0200
    Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-17 21:17 +0200
      Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-17 17:02 -0400
        Re: HTTPS data in a form "Peter H. Coffin" <hellsop@ninehells.com> - 2016-09-21 11:33 -0500
          Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-23 08:47 -0400
          Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-24 22:11 +0200
      Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-19 21:36 +0200
        Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-19 23:28 +0200
          Re: HTTPS data in a form "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-09-19 23:44 +0200
            Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-19 23:57 +0200
              Re: HTTPS data in a form "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-09-20 19:00 +0200
          Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-19 21:00 -0400
          Re: HTTPS data in a form Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2016-09-20 05:59 +0000
            Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-20 15:40 +0200
              Re: HTTPS data in a form "J.O. Aho" <user@example.net> - 2016-09-20 18:39 +0200
                Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-20 14:36 -0400
              Re: HTTPS data in a form Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2016-09-20 21:04 +0000
                Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-24 21:58 +0200
                Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-26 19:43 +0200
              Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-23 09:14 +0200
                Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-24 22:00 +0200
                Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-26 19:44 +0200
          Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-20 08:20 +0200
            Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-20 15:41 +0200
              Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-23 09:02 +0200
                Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-24 22:06 +0200
                Re: HTTPS data in a form Arno Welzel <usenet@arnowelzel.de> - 2016-09-26 19:49 +0200
  Re: HTTPS data in a form Richard Damon <Richard@Damon-Family.org> - 2016-09-18 14:22 -0400
    Re: HTTPS data in a form Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-19 23:36 +0200
      Re: HTTPS data in a form Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-19 21:03 -0400
  Re: HTTPS data in a form "Peter H. Coffin" <hellsop@ninehells.com> - 2016-09-21 11:29 -0500

csiph-web