Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says

Path	csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!1.eu.feeder.erje.net!ecngs!feeder2.ecngs.de!46.4.82.166.MISMATCH!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From	"Christoph M. Becker" <cmbecker69@arcor.de>
Newsgroups	comp.lang.php
Subject	Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says
Date	Mon, 11 May 2015 23:06:22 +0200
Organization	solani.org
Lines	41
Message-ID	<mir5kd$i73$1@solani.org> (permalink)
References	<SOydnYeYVLkaLNLInZ2dnUU78VcAAAAA@giganews.com> <miok25$g1d$1@dont-email.me> <L7KdnUdJy934R9LInZ2dnUU78T-dnZ2d@giganews.com> <k222lapa6pu0dl511m59788njeqm12dh78@4ax.com>
Mime-Version	1.0
Content-Type	text/plain; charset=utf-8
Content-Transfer-Encoding	7bit
X-Trace	solani.org 1431378381 18659 eJwNx0EBACAIA8BKgIAaB3HrH0HvdzFSs6dnpAeDoiUbg1bd11gGnNaVoOFfAb/8n8e22IoHO/MR5w== (11 May 2015 21:06:21 GMT)
X-Complaints-To	abuse@news.solani.org
NNTP-Posting-Date	Mon, 11 May 2015 21:06:21 +0000 (UTC)
User-Agent	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0
X-User-ID	eJwFwYEBACAEBMCVFP80jsT+I3QH5WK5ETQMpkQTpw80VrlebxXkdN5dfL4titr3DQU+GR8djBFn
In-Reply-To	<k222lapa6pu0dl511m59788njeqm12dh78@4ax.com>
Cancel-Lock	sha1:dHzOzQsyxY/iA+BcjFy3WfkntNY=
X-NNTP-Posting-Host	eJwFwYkBwCAIA8CVhCZBx1Ge/UfoHT+ZMiAKHE4d5hp4ly0X+1nU3UDj5iiyzNXJwja2gB8jsREx
Xref	csiph.com comp.lang.php:15306

Show key headers only | View raw

Jim Higgins wrote:

> On Sun, 10 May 2015 23:23:31 +0100, in
> <L7KdnUdJy934R9LInZ2dnUU78T-dnZ2d@giganews.com>, user1
> <none@none.invalid> wrote:
> 
>> On 10/05/2015 22:55, Jerry Stuckle wrote:
>>> On 5/10/2015 3:29 PM, user1 wrote:
>>>> PHP Hash Comparison Weakness A Threat To Websites, Researcher Says
>>>>
>>>> "Flaw could allow attackers to compromise user accounts, WhiteHat
>>>> Security's Robert Hansen -- aka 'RSnake' -- says in new finding on
>>>> 'Magic Hash' vulnerability. "
>>>>
>>>> URL:
>>>> http://www.darkreading.com/vulnerabilities---threats/php-hash-comparison-weakness-a-threat-to-websites-researcher-says-/d/d-id/1320353
>>>
>>> Which is not a problem with using proper coding techniques.
>>
>> Indeed, a fair point good sir.
>>
>> Hopefully everyone knows about using proper coding techniques.
>>
>> But just in-case some don't, or are still at a learning stage- perhaps 
>> you could recommend a good website as a source of information on proper 
>> coding techniques?
> 
> The article seems to give you the proper technique to overcome this
> issue. Just read it to the very end end.

Indeed, using === resp. !== would help to solve this issue, but it still
wouldn't secure against potential timing attacks.  Therefore one should
use hash_equals() or a respective userland implementation for PHP
versions before 5.6.0, or maybe preferably the password hashing
functions[1] introduced in PHP 5.5.0 (or a respective fallback).

[1] <http://php.net/manual/en/ref.password.php>

-- 
Christoph M. Becker

Thread

Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says user1 <none@none.invalid> - 2015-05-10 20:29 +0100
  Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says Jerry Stuckle <jstucklex@attglobal.net> - 2015-05-10 17:55 -0400
    Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says user1 <none@none.invalid> - 2015-05-10 23:23 +0100
      Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says Jerry Stuckle <jstucklex@attglobal.net> - 2015-05-10 18:46 -0400
        Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says user1 <none@none.invalid> - 2015-05-11 22:49 +0100
      Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says Jim Higgins <ILikeMy@Privacy.invalid> - 2015-05-11 19:53 +0000
        Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-05-11 23:06 +0200
          Re: Article: PHP Hash Comparison Weakness A Threat To Websites, Researcher Says user1 <none@none.invalid> - 2015-05-11 22:54 +0100

csiph-web