Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #15306
| From | "Christoph M. Becker" <cmbecker69@arcor.de> |
|---|---|
| Newsgroups | comp.lang.php |
| Subject | Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says |
| Date | 2015-05-11 23:06 +0200 |
| Organization | solani.org |
| Message-ID | <mir5kd$i73$1@solani.org> (permalink) |
| References | <SOydnYeYVLkaLNLInZ2dnUU78VcAAAAA@giganews.com> <miok25$g1d$1@dont-email.me> <L7KdnUdJy934R9LInZ2dnUU78T-dnZ2d@giganews.com> <k222lapa6pu0dl511m59788njeqm12dh78@4ax.com> |
Jim Higgins wrote: > On Sun, 10 May 2015 23:23:31 +0100, in > <L7KdnUdJy934R9LInZ2dnUU78T-dnZ2d@giganews.com>, user1 > <none@none.invalid> wrote: > >> On 10/05/2015 22:55, Jerry Stuckle wrote: >>> On 5/10/2015 3:29 PM, user1 wrote: >>>> PHP Hash Comparison Weakness A Threat To Websites, Researcher Says >>>> >>>> "Flaw could allow attackers to compromise user accounts, WhiteHat >>>> Security's Robert Hansen -- aka 'RSnake' -- says in new finding on >>>> 'Magic Hash' vulnerability. " >>>> >>>> URL: >>>> http://www.darkreading.com/vulnerabilities---threats/php-hash-comparison-weakness-a-threat-to-websites-researcher-says-/d/d-id/1320353 >>> >>> Which is not a problem with using proper coding techniques. >> >> Indeed, a fair point good sir. >> >> Hopefully everyone knows about using proper coding techniques. >> >> But just in-case some don't, or are still at a learning stage- perhaps >> you could recommend a good website as a source of information on proper >> coding techniques? > > The article seems to give you the proper technique to overcome this > issue. Just read it to the very end end. Indeed, using === resp. !== would help to solve this issue, but it still wouldn't secure against potential timing attacks. Therefore one should use hash_equals() or a respective userland implementation for PHP versions before 5.6.0, or maybe preferably the password hashing functions[1] introduced in PHP 5.5.0 (or a respective fallback). [1] <http://php.net/manual/en/ref.password.php> -- Christoph M. Becker
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says user1 <none@none.invalid> - 2015-05-10 20:29 +0100
Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says Jerry Stuckle <jstucklex@attglobal.net> - 2015-05-10 17:55 -0400
Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says user1 <none@none.invalid> - 2015-05-10 23:23 +0100
Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says Jerry Stuckle <jstucklex@attglobal.net> - 2015-05-10 18:46 -0400
Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says user1 <none@none.invalid> - 2015-05-11 22:49 +0100
Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says Jim Higgins <ILikeMy@Privacy.invalid> - 2015-05-11 19:53 +0000
Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-05-11 23:06 +0200
Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says user1 <none@none.invalid> - 2015-05-11 22:54 +0100
csiph-web