ircmaxell

Just because you choose to ignore valid criticism, that doesnt mean there is no criticism. Go read https://blog.ircmaxell.com/2017/10/disclosure-wordpress-wpdb-sql-injec… A couple of little snippets to highlight the point I'm trying to make: > The current system is insecure-by-design. That doesn’t mean it’s always hackable, but it means you have to actively work to make it not attackable. It’s better to switch to a design that’s secure-by-default and make the insecure the exceptional case. > The best path forward would be to switch to PDO/MySQLi and use real prepared statements and not emulate them in PHP land. That’s the best path forward. But given that the core wordpress team basically ignore this type of suggestion from PHP core contributors, why would I expect you to believe me about it here?

I really wish that people would stop referencing that "Fractal of Bad Design" article. It's outdated and mostly irrelevant now (April 2012, PHP was at 5.4 then, it's at 7.2 now). It's not that I want to defend PHP, I just think people should judge PHP for what it is now instead of what it was several major changes ago. Besides, the author seems to misunderstand a great many things about PHP and languages in general. Here's a short rebuttal (also from April 2012): https://blog.ircmaxell.com/2012/04/php-sucks-but-i-like-it.html that explains some of the misunderstandings.

scrypt is okay if you use it correctly. It's too easy to use it incorrectly, though, because scrypt is a low-level algorithm that wasn't specifically designed for password storage. [1] http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html In order to be able to tell people to "just use scrypt", we would need to have a sort of standard wrapper that uses the correct parameters by default and produces identical results in every common programming language.

>> Spamming the input with an array of whatever OpenSSL algorithms Ruby happens to make available, rather than using a memory hard KDF like scrypt, is a bad smell. Sooner or later key-derivation schemes gets outdated and requires a better version as happened to bcrypt [1] and will happen to scrypt [2]. It is not "whatever OpenSSL provides" but just combining strong algorithms over to spread the "getting outdated" risks. Think like you are investing your money? Would you prefer betting on just one thing or spreading it over various different investment opportunities? [1] http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html [2] http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html

Can you unroll argon2 for cpu-vs-memory tradeoff like scrypt? Both are supposed to be memory-intensive, but in scrypt you can get 2x slowdown by using 2x less memory and just computing the missing bits. (http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html)

Is there any significant evidence that peppering passwords helps? I've seen arguments for and against peppering out on the big bad internet. Everyone has opinions but there are few people's opinions about crypto that I actually trust. The best article I've seen against this technique is by ircmaxell [0]. Nicely summed up in this sentence "It is far better to use standard, proven algorithms then to create your own to incorporate a pepper." Anyone have source material (academic paper, Bruce "The Crypto God" Schneier blog post) that shreds some light on peppering passwords? I'd be much more interested in how many iterations of bcryprt Slack were using. That has a much bigger bearing on events for me. Anyone at Slack know/want to answer that question? [0] http://blog.ircmaxell.com/2012/04/properly-salting-passwords-case-agai…

Instead of taking the troll bait here, I'll just link to this excellent blog post by Anthony Ferrara that sums up my position well. http://blog.ircmaxell.com/2014/10/fud-and-flames-and-trolls-oh-my.html > Those That Have Passion

And the follow up: http://blog.ircmaxell.com/2014/10/a-followup-to-open-letter-to-php-fig…

Thing is, scrypt isn't a panacea - there are ways to make it CPU hard instead of memory hard - http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html

Hopefully, the 'salt' passed to HMAC-SHA256 is a pepper (preferably stored outside the database), not the same user salt as what bcrypt uses. As for scrypt, it definitely has great potential, but I still feel it's too new and not as well understood to be used 100% correctly in production by most folks (see also http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html).

> These functions belong to a family of functions known as key derivation functions: they use hashing to produce a digest which is suitable for use as a password hash. KDFs are not for storing password hashes, they are for key derivation. This is a subtle point, the main thing is to use KDFs as KDFs (to derive keys that are then used to encrypt data). Details in the first link here (the second is about common mistakes when using scrypt): - http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html (bad title, he's referring to pass storage, not KDF usage) - http://vnhacker.blogspot.com/2014/04/fairy-tales-in-password-hashing-w… Another consideration is plausible deniability (PD) for situations where you're compelled to disclose your password(s). Our company writes Mac encryption software that specializes in this (and it uses scrypt). Here's a list of tools that offer PD (ours is called Espionage): https://en.wikipedia.org/wiki/Deniable_encryption#Software I compared Espionage's PD to TrueCrypt's on reddit: http://www.reddit.com/r/security/comments/2b5icu/major_advancements_in…

Wordpress, Joomla and Drupal are not good examples of "good" PHP code. They work, and are used extensively, but experienced developers who care about code quality blow a gasket when they look at the source code. To do proper PHP development you should have a local VM. I created something to help in that regard[0]. It's been fairly well received. There's also websites like PHP The Right Way [1] that act like a collection of best practices. If you're not using Composer[2] you should start doing so. I wish Javascript had a package manager as robust and useful as Composer (I know of Bower, but imo it's not nearly as good!). PHP Developer[3] is a source of good daily blog posts. The ones I read on a regular basis are ircmaxell [4], fabpot[5], lornajane[6], philsturgeon[7], richardmiller[8], and phparch[9]. I also sometimes write some things[10]. [0] https://puphpet.com [1] http://phptherightway.com [2] http://getcomposer.org [3] http://phpdeveloper.org [4] http://blog.ircmaxell.com [5] http://fabien.potencier.org [6] http://lornajane.net [7] http://philsturgeon.co.uk/blog [8] http://richardmiller.co.uk [9] http://phparch.com [10] https://jtreminio.com

> As to preventing timing attacks you can add a delay to give a uniform response time. You have to be very careful with how you implement the delay to prevent the timing signal from still propagating to the attacker. https://blog.ircmaxell.com/2014/11/its-all-about-time.html#A-Note-On-%…

I been doing some reading about this in an attempt to answer my own question. It turns out, there is potential for a timing attack during the verification stage. Provided you store the plain text token in the database, an attacker can deduce a valid token by submitting various guesses to the server. Hashing the token protects against this. For more detail: http://blog.ircmaxell.com/2014/11/its-all-about-time.html

One concern I have here, is that people are going to perceive this post as "this is what you should do and it's easy!", because the post doesn't really address the complexities of implementing this kind of thing. As a result, we're probably going to have a bunch more issues like this one: http://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with… I'm not looking forward to having to talk people off that particular ledge for the next several months...

Two years ago, PHP's package manager, Composer, was sped up by disabling the garbage collector: http://blog.ircmaxell.com/2014/12/what-about-garbage.html (Or more accurately the cycle collector. You can't turn off reference counting.)

How to protect from timing attacks - It's All About Time: http://blog.ircmaxell.com/2014/11/its-all-about-time.html

Mainly because it adds complexity, and complexity in crypto can hide subtle bugs. Example: http://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with…

Sure, not exactly hard to find though... - http://www.theregister.co.uk/2014/12/31/want_to_have_your_server_pwned… - "Over 78% of PHP installs are insecure" - http://blog.ircmaxell.com/2014/12/php-install-statistics.html - http://stackoverflow.com/a/1567392

Reminds me of this hack using the x-forwarded-for header: http://blog.ircmaxell.com/2012/11/anatomy-of-attack-how-i-hacked.html (Anatomy of an Attack: How I Hacked StackOverflow) and this: http://xkcd.com/327/ (Exploits of a Mom) Never trust the client....

Here's an article on the composer change: http://blog.ircmaxell.com/2014/12/what-about-garbage.html

It's a good thing there's no poorly written PHP in the wild and everyone is really, really good at patching PHP immediately upon update. /s edit: http://blog.ircmaxell.com/2014/12/php-install-statistics.html

Some explanation here: http://blog.ircmaxell.com/2014/08/introducing-recki-ct.html (it's vaguely redundant with the readme, but there is some additional stuff)

Thank you, I looked few pages. Looks like paper is useless most of the time. According by this article http://blog.ircmaxell.com/2012/04/properly-salting-passwords-case-agai… better solution is encrypt(hash(salt + password))

Anthony Ferrara did a similar presentation a while back: http://blog.ircmaxell.com/2012/05/dont-be-stupid-grasp-solid-slides.ht…

And the target response is http://blog.ircmaxell.com/2012/04/php-sucks-but-i-like-it.html

Anthony Ferrara did a rebuttal here: http://blog.ircmaxell.com/2012/04/php-sucks-but-i-like-it.html Not a good rebuttal but I've done my own here: http://news.ycombinator.com/item?id=4177516

Udacity has a Networking for Web Developers course[0], but I'd recommend trying out things (such as running a simple web-app on your own server). Things like: - Running https://certbot.eff.org/instructions - Trying out a few different web servers (apache/nginx/caddy) - Playing around with load-balancers on $cloud_provider. - Spending time with docker networking (https://docs.docker.com/config/containers/container-networking/) - Playing around with various X-Forwarded header options in the context of your application For a web developer, the most useful skill is knowing what each and every component on the pipeline is doing before your code executes on the request. As a common eg, if your application seems to be loading stylesheets from `http://` instead of `https://` despite being loaded over HTTPS, it is often because your application didn't honor the X-Forwarded-Proto header (which most frameworks will do for you). Similarly, seeing a local IP address (192.168.x.y for eg) on a log, and realizing that you should be using the X-Forwarded-Ip by "trusting your proxy"[1] and doing it securely[2].[3]. [0]: https://www.udacity.com/course/networking-for-web-developers--ud256 [1]: https://expressjs.com/en/guide/behind-proxies.html [2]: https://shubs.io/enumerating-ips-in-x-forwarded-headers-to-bypass-403-… [3]: https://blog.ircmaxell.com/2012/11/anatomy-of-attack-how-i-hacked.html

This is almost always less secure than KC alone, when KC is a well-known secure cipher. A simple example would be a CC that hex-encodes the plaintext before applying some transformation on the data (before you laugh, this exists in enterprise systems today). This means CC would effectively expand the underlying data 200% (0xA1 -> 0x4131) and substantially degrade the security of a block-based cipher (32-bit block -> effectively 16-bits). Here's a link to a practical case of unsafe composition (in hashing): http://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with… A bit more detail on randomly composing encryption algorithms: http://blog.cryptographyengineering.com/2012/02/multiple-encryption.ht… edit: It would be better to compose CC(KC(P)) so CC can't leak any information about P or degrade KC. Any reluctance to show the world the output of CC should suggest the low-practical-value of CC.

> A properly implemented, simple pepper can only help password security and can't hurt it. Well, yes. But what is the definition of "properly"? There are definitely constructions of "pepper" that look simple, but drastically hurt overall security: bcrypt(hmac(password, key), salt) If hmac returns raw bytes, you're in real trouble: http://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with… It's sort of like the difference between birth control and counting based contraceptive methods (Standard Days Method). Executed perfectly, they are equally as effective. But with a slight error, one stays roughly as effective (losing maybe 5 to 10% effectiveness overall) while the other drops drastically (down to 10 to 20% effectiveness). Considering using encryption is as effective as using a pepper, and it's less prone to weakening the core password hash, I suggest using encryption instead of peppers.