Path: csiph.com!weretis.net!feeder4.news.weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail From: Thomas 'PointedEars' Lahn Newsgroups: comp.lang.php Subject: Re: HTTPS data in a form Date: Tue, 20 Sep 2016 15:41:20 +0200 Organization: PointedEars Software (PES) Lines: 42 Message-ID: <7205327.T7Z3S40VBb@PointedEars.de> References: <52647a62-05fe-ade7-9de8-e434f646aad9@arnowelzel.de> <2368565.mvXUDI8C0e@PointedEars.de> <0538bd0a-15af-6afe-260c-38fb970c56d9@arnowelzel.de> <3934285.LvFx2qVVIh@PointedEars.de> <00623da7-53b3-3d15-17ac-bbbce93fdded@arnowelzel.de> Reply-To: Thomas 'PointedEars' Lahn Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8Bit X-Trace: solani.org 1474378880 11094 eJwFwYEBgDAIA7CXQCmOcwqj/59ggjc954tEBgQdkeP3lumg2x9L2NzABmaLGUYDtxXF1v4vgBIS (20 Sep 2016 13:41:20 GMT) X-Complaints-To: abuse@news.solani.org NNTP-Posting-Date: Tue, 20 Sep 2016 13:41:20 +0000 (UTC) User-Agent: KNode/4.14.2 X-NNTP-Posting-Host: eJwFwYEBACAEBMCVyD81jsT+I3RHc/UKOB0czlXRigxSxvrerl4PZaZnYyX87INVOdLbH/EBHpwQ/g== X-User-ID: eJwFwQkBwDAIA0BL40kocigF/xJ2B6Owwwk6FlvI6Oc5RZzVOdS8um0PdYN8ripRWJlzs3e+MuCzlGez8B9eNBWk Cancel-Lock: sha1:IeA+BjlwBG1/eigt8iuv0doMqws= Xref: csiph.com comp.lang.php:17078 Arno Welzel wrote: > Thomas 'PointedEars' Lahn schrieb am 2016-09-19 um 23:28: > > […] One of the major principles in encryption is that the secret > has to be protected, not the algorithm. Utter nonsense. > If the attacker gains access to the client itself, even HTTPS does not > help […] Yes. Non sequitur. >> Checking a username/password then means comparing the hash of the >> provided username/password against the stored hash(es) *server-side*. >> The hash should be computed using a strong hashing algorithm (so _not_ >> plain MD5 or SHA1, but rather the likes of bcrypt [default for >> password_hash() since PHP 5.5.0] and scrypt with a strong salt [using the >> default for password_hash() is recommended as of PHP 7.0.0 as the “salt” >> option was deprecated]). > > Well - the source code of bcrypt for JavaScript is available here: > > > > Didn't you just say that it is a bad idea to have the source code for an > encryption method available? ;-) I said that it is a bad idea to expose the used encryption algorithm *on the client*. Because then the attacker knows the algorithm already and it is easier for them to run an attack. Also, you are having the common misconception that “JavaScript” means client-side and unprivileged code. (Note that the first variant presented there is the one for Node.js.) -- PointedEars Zend Certified PHP Engineer | Twitter: @PointedEars2 Please do not cc me. / Bitte keine Kopien per E-Mail.