759 reputation
1020
bio website
location
age
visits member for 2 years, 3 months
seen Jul 28 at 8:34

Aug
20
comment Do you need to encrypt session data?
So to summarize, there's NO need for encryption if there's NO sensitive info in session data, whether on shared hosting or private hosting.
Aug
19
comment Do you need to encrypt session data?
Ok you mention personal / sensitive information, so if I'm not storing this kind of info (i.e., I only store loggedin = true), then there's no need for encryption?
Aug
19
comment Do you need to encrypt session data?
Thanks, BTW here's an example of the script I'm talking about zimuel.it/en/encrypt-php-session-data it's unclear what's his purpose. Maybe he's storing sensitive info in sessions? He stores the key in the user cookie and encrypted data remains in /tmp (or the designated session path). Regardless, my question is more on why is it necessary to encrypt it? For example, if I don't encrypt data and if /tmp was compromised, an attacker really can't do anything with it right as long as there is session hijacking prevention?
Aug
19
comment Do you need to encrypt session data?
@Polynomial That's exactly what I mean. Do you think it's necessary to encrypt it if you're not storing sensitive info in the session data?
Aug
19
comment Do you need to encrypt session data?
@curiousguy I am not sure what tmpfs is but /tmp is usually just a regular folder in windows or linux. More info about it here: php.net/manual/en/…
Aug
19
comment Do you need to encrypt session data?
@curiousguy What do you mean? If you mean /tmpthen /tmp is PHP's default session folder in a shared hosting environment.
Aug
14
comment HTTP Basic auth password storage more secure than Digest auth
@symcbean Should have cleared it this is for REST API server. BTW, Cpanel uses HTTP auth.
Aug
13
comment Is it okay for API secret to be stored in plain text or decrypt-able?
Yes I understand it may not be called API key or API secret literally but the purpose is quite the same: API key = Username, API secret = Password. BTW, I do have a separate question that you may want to answer: security.stackexchange.com/questions/18563 Note that I pointed out not using SSL in that question but you can note about SSL in your answer, if ever.
Aug
13
comment Is it okay for API secret to be stored in plain text or decrypt-able?
I know my example was AWS but I also mean other APIs, and other APIs implement HTTP Digest auth. You mention it's insecure but that is only true if the API server is not using SSL/TLS right?
Aug
13
comment Is it okay for API secret to be stored in plain text or decrypt-able?
It's not clear to me why nothing is gained. In HTTP Digest auth you can store the HA1 in md5 in your database. So the password (which can be used as API secret key) is never stored in plain text. AFAIK in Digest auth, the client only supplies username and plain text password, while server only stores the hash so the database is protected with hashed passwords. Didn't this example just gained password secrecy? If the attacker gains the database of hashes, he can't simply use it since he must crack it first to know the plain text version.
Aug
13
comment HTTP Basic auth password storage more secure than Digest auth
Thanks for the pointers. So I guess if you don't need the "ugly" interface (i.e., you are using HTTP auth for REST API server, and client's don't see/use the screen because they hard-code the login process), then I guess basic auth is still pretty good on SSL.
Aug
13
comment Does truncating the cryptographic hash make it impossible to crack?
I now understand the risk involved with this but if we prevent duplicate/matching hash stored in the database then this fixes the issue of collision right?
Aug
13
comment Is it okay for API secret to be stored in plain text or decrypt-able?
Is there any reason why an API server can't hash user input (i.e., hash the key)? And compare it to the hashed key stored in the server. Seems to me there's no special reason why keys can't be hashed.
Aug
13
comment Is it okay for API secret to be stored in plain text or decrypt-able?
What is preventing an API server from hashing a key for storage since it can hash the user input (i.e., the client) for comparison the same way password storage works?
Aug
13
comment Is it okay for API secret to be stored in plain text or decrypt-able?
@DavidSchwartz I didn't say that. I said it's either plain text or decrypt-able.
Aug
13
comment Signed request vs HTTP digest auth for API authentication?
@curiousguy To clarify what you're saying is possible with MITM attack right and that is also possible with SSL MITM attack?
Aug
12
comment Signed request vs HTTP digest auth for API authentication?
@curiousguy Yes that is exactly what I mean but how can an attacker modify the request? He must first know the user-password pair before he can send a modified request right?
Aug
12
comment Signed request vs HTTP digest auth for API authentication?
You are right this is complicated and messy. And the log will probably be so big. SSL it is.
Aug
12
comment Signed request vs HTTP digest auth for API authentication?
Purely scientific purposes, SSL is cheap anyway but this is just for kicks.
Aug
12
comment Signed request vs HTTP digest auth for API authentication?
@curiousguy Well how can you do that since either methods require you know the API secret first right? And the API secret is not transmitted in plain sight even without SSL.