Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #4421

Re: Magic quotes? Should I still be cautious?

Path csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!gegeweb.org!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail
From Arno Welzel <usenet@arnowelzel.de>
Newsgroups comp.lang.php
Subject Re: Magic quotes? Should I still be cautious?
Date Wed, 11 Jan 2012 15:43:34 +0100
Organization A noiseless patient Spider
Lines 48
Message-ID <4F0DA016.9030503@arnowelzel.de> (permalink)
References <apkpf7pepdppho2ve4fr8nu8u087hmcakl@4ax.com> <4F046877.3080409@arnowelzel.de> <4f05a0b4$0$6924$e4fe514c@news2.news.xs4all.nl> <9mmq09F283U1@mid.uni-berlin.de> <je5fng$orh$1@dont-email.me> <je6khb$uua$1@news.albasani.net> <je6t5d$ivk$1@dont-email.me> <je7h6e$sfu$1@news.albasani.net> <je7v4i$qce$1@dont-email.me> <4F09F3F2.50108@arnowelzel.de> <jed04k$i08$1@dont-email.me> <4F0D5DBD.4050404@arnowelzel.de> <jejt7c$626$5@news.albasani.net>
Mime-Version 1.0
Content-Type text/plain; charset=UTF-8
Content-Transfer-Encoding 7bit
Injection-Info mx04.eternal-september.org; posting-host="dd4uQGf4fHOQcq7/hg1u1Q"; logging-data="27385"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18SwKQ34YPAnUFLiEMzNGJHCaZcAct3t5g="
User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20111105 Thunderbird/8.0
In-Reply-To <jejt7c$626$5@news.albasani.net>
Cancel-Lock sha1:G6r0kNfpqhQF5k6NS1/hXIyNXas=
Xref x330-a1.tempe.blueboxinc.net comp.lang.php:4421

Show key headers only | View raw

The Natural Philosopher, 2012-01-11 12:53:

> Arno Welzel wrote:
>> Jerry Stuckle, 2012-01-08 21:59:
>>
>> [...]
>>> I do other things also, but don't want to get into too much detail in a 
>>> public forum.
>>
>> "Security by obscurity" does not work.
> 
> actually it does. It is the basis for all passwords for example.

I did'nt talk about passwords m( but *procedures*. And a secret password
is not "security by obscurity".

In cryptography this is the most important principle: Keep the password
or private key as a secret but not the procedure - and cryptographic
procedures which are not documented have to be considered insecure.

If you say "i do something in my application to keep it secure, but i
won't tell anybody what this is - because if i would, a hacker could use
this information to attack my application" - then your procedure is
flawed, since you risk that the whole thing may fail as soon as someone
find's out, how it works.

I procedure has to be secure *even* when everybody knows how it works.

For example: A packet filter in Linux is also not secure because nobody
knows how it works.

Or another example: A user database must never store plain text
passwords but only in an encrypted form - but the procedure of the
encryption must be documented. Otherwise you never will know, if there
are flaws in the procedure which are already used by attackers. And if
you are not an expert in cryptography don't even think about creating
your own "secure" encryption - and the same often also applies to code
which is considered to be "secure" against attacks.

>   If your security only relies on
>> the fact, that you try to keep the procedures or code a secret, it is
>> flawed.


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Magic quotes? Should I still be cautious? Michael Joel <no@please.com> - 2011-12-29 15:55 -0500
  Re: Magic quotes? Should I still be cautious? Michael Fesser <netizen@gmx.de> - 2011-12-29 22:04 +0100
    Re: Magic quotes? Should I still be cautious? Michael Joel <no@please.com> - 2011-12-29 16:53 -0500
      Re: Magic quotes? Should I still be cautious? Michael Joel <no@please.com> - 2011-12-29 17:08 -0500
    Re: Magic quotes? Should I still be cautious? Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2011-12-29 23:22 +0100
  Re: Magic quotes? Should I still be cautious? "Peter H. Coffin" <hellsop@ninehells.com> - 2011-12-29 17:53 -0600
    Re: Magic quotes? Should I still be cautious? Michael Joel <no@please.com> - 2011-12-29 23:32 -0500
      Re: Magic quotes? Should I still be cautious? Erwin Moller <Since_humans_read_this_I_am_spammed_too_much@spamyourself.com> - 2011-12-30 12:38 +0100
        Re: Magic quotes? Should I still be cautious? Michael Joel <no@please.com> - 2011-12-30 09:52 -0500
          Re: Magic quotes? Should I still be cautious? Erwin Moller <Since_humans_read_this_I_am_spammed_too_much@spamyourself.com> - 2012-01-02 15:02 +0100
      Re: Magic quotes? Should I still be cautious? Michael Fesser <netizen@gmx.de> - 2011-12-30 13:18 +0100
  Re: Magic quotes? Should I still be cautious? "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2011-12-30 10:26 +0100
  Re: Magic quotes? Should I still be cautious? Erwin Moller <Since_humans_read_this_I_am_spammed_too_much@spamyourself.com> - 2011-12-30 14:42 +0100
    Re: Magic quotes? Should I still be cautious? Michael Joel <no@please.com> - 2011-12-30 09:52 -0500
  Re: Magic quotes? Should I still be cautious? Arno Welzel <usenet@arnowelzel.de> - 2012-01-04 15:55 +0100
    Re: Magic quotes? Should I still be cautious? Erwin Moller <Since_humans_read_this_I_am_spammed_too_much@spamyourself.com> - 2012-01-05 14:08 +0100
      Re: Magic quotes? Should I still be cautious? Arno Welzel <usenet@arnowelzel.de> - 2012-01-05 14:22 +0100
        Re: Magic quotes? Should I still be cautious? The Natural Philosopher <tnp@invalid.invalid> - 2012-01-05 13:36 +0000
          Re: Magic quotes? Should I still be cautious? Erwin Moller <Since_humans_read_this_I_am_spammed_too_much@spamyourself.com> - 2012-01-05 15:20 +0100
            Re: Magic quotes? Should I still be cautious? The Natural Philosopher <tnp@invalid.invalid> - 2012-01-05 15:49 +0000
        Re: Magic quotes? Should I still be cautious? Erwin Moller <Since_humans_read_this_I_am_spammed_too_much@spamyourself.com> - 2012-01-05 14:39 +0100
      Re: Magic quotes? Should I still be cautious? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-06 00:28 +0100
        Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-05 19:36 -0500
          Re: Magic quotes? Should I still be cautious? Erwin Moller <Since_humans_read_this_I_am_spammed_too_much@spamyourself.com> - 2012-01-06 11:16 +0100
          Re: Magic quotes? Should I still be cautious? Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2012-01-06 12:05 +0100
            Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-06 08:32 -0500
              Re: Magic quotes? Should I still be cautious? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-06 18:18 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-06 13:04 -0500
                Re: Magic quotes? Should I still be cautious? Arno Welzel <usenet@arnowelzel.de> - 2012-01-08 20:48 +0100
              Re: Magic quotes? Should I still be cautious? Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2012-01-06 20:14 +0100
                Re: Magic quotes? Should I still be cautious? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-06 20:24 +0100
                Re: Magic quotes? Should I still be cautious? The Natural Philosopher <tnp@invalid.invalid> - 2012-01-06 19:34 +0000
                Re: Magic quotes? Should I still be cautious? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-06 21:11 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-06 18:12 -0500
                Re: Magic quotes? Should I still be cautious? Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2012-01-07 17:59 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-07 15:54 -0500
                Re: Magic quotes? Should I still be cautious? Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2012-01-08 02:13 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-07 20:33 -0500
                Re: Magic quotes? Should I still be cautious? Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2012-01-09 00:21 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 19:05 -0500
                Re: Magic quotes? Should I still be cautious? Arno Welzel <usenet@arnowelzel.de> - 2012-01-08 20:52 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-08 15:59 -0500
                Re: Magic quotes? Should I still be cautious? Arno Welzel <usenet@arnowelzel.de> - 2012-01-11 11:00 +0100
                Re: Magic quotes? Should I still be cautious? The Natural Philosopher <tnp@invalid.invalid> - 2012-01-11 11:53 +0000
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-11 08:45 -0500
                Re: Magic quotes? Should I still be cautious? Arno Welzel <usenet@arnowelzel.de> - 2012-01-11 15:43 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-11 08:44 -0500
                Re: Magic quotes? Should I still be cautious? Arno Welzel <usenet@arnowelzel.de> - 2012-01-11 15:47 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-11 09:51 -0500
                Re: Magic quotes? Should I still be cautious? Arno Welzel <usenet@arnowelzel.de> - 2012-01-11 18:09 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-11 14:01 -0500
                Re: Magic quotes? Should I still be cautious? Arno Welzel <usenet@arnowelzel.de> - 2012-01-12 08:58 +0100
          Re: Magic quotes? Should I still be cautious? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-06 17:41 +0100
            Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-06 13:05 -0500
        Re: Magic quotes? Should I still be cautious? Erwin Moller <Since_humans_read_this_I_am_spammed_too_much@spamyourself.com> - 2012-01-06 11:07 +0100
          Re: Magic quotes? Should I still be cautious? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-06 18:05 +0100
            Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-06 13:07 -0500
              Re: Magic quotes? Should I still be cautious? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2012-01-06 19:45 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-06 18:09 -0500
                Re: Magic quotes? Should I still be cautious? Thomas Mlynarczyk <thomas@mlynarczyk-webdesign.de> - 2012-01-07 18:08 +0100
                Re: Magic quotes? Should I still be cautious? Jerry Stuckle <jstucklex@attglobal.net> - 2012-01-07 15:59 -0500

csiph-web