¡@
php Programming Glossary: compromisedWhat do I need to store in the php session when user logged in? http://stackoverflow.com/questions/1221447/what-do-i-need-to-store-in-the-php-session-when-user-logged-in no solution is fool proof. If your session_id is compromised you are pretty much done for. The above strategies are just..
Encrypt in Javascript, decrypt in PHP, using public-key cryptography http://stackoverflow.com/questions/12457234/encrypt-in-javascript-decrypt-in-php-using-public-key-cryptography in case the server which stores the private key is later compromised. Servers compromised scenario someone gets his hands on backups.. which stores the private key is later compromised. Servers compromised scenario someone gets his hands on backups for all machines..
Best way to encode passwords in PHP http://stackoverflow.com/questions/1391613/best-way-to-encode-passwords-in-php used in security discussions User Frederic's email is compromised. This could be from leaving his computer unlocked or using a..
Best practices: safest method to store passwords in a table? [closed] http://stackoverflow.com/questions/1592608/best-practices-safest-method-to-store-passwords-in-a-table secure password storage system. Even if your database is compromised your user's passwords will still be exceedingly difficult and..
What security problems could come from exposing phpinfo() to end users? http://stackoverflow.com/questions/3196011/what-security-problems-could-come-from-exposing-phpinfo-to-end-users another vulnerability could lead to your site becoming compromised. Obviously the less specific info hackers have about your system..
How does this giant regex work? http://stackoverflow.com/questions/3328235/how-does-this-giant-regex-work and you must remove it immediately . Your system maybe compromised further. This is what the backdoor looks like when it is accessed..
mysql_escape_string VS mysql_real_escape_string http://stackoverflow.com/questions/3665572/mysql-escape-string-vs-mysql-real-escape-string
Secure hash and salt for PHP passwords http://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords hashes. Reset everyone's passwords when the database is compromised. Implement a reasonable 8 10 character minimum length plus require.. all the passwords in the system. If your database is compromised you will need enough time to at least lock the system down if..
PHP Session Fixation / Hijacking http://stackoverflow.com/questions/5081025/php-session-fixation-hijacking and Hijacking is only about how the session identifier is compromised. In fixation the identifier is set to a value that the attacker.. the effects of the two are the same once the identifier is compromised. Session ID Regeneration Whenever you regenerate the session..
PHP 2-way encryption: I need to store passwords that can be retrieved http://stackoverflow.com/questions/5089841/php-2-way-encryption-i-need-to-store-passwords-that-can-be-retrieved The benefit there is that any 2 of the keys can be compromised without the data being compromised. If there's a SQL Injection.. 2 of the keys can be compromised without the data being compromised. If there's a SQL Injection attack they can get the userKey..
Best methods to clean up a hacked site with no clean version available? http://stackoverflow.com/questions/6337976/best-methods-to-clean-up-a-hacked-site-with-no-clean-version-available educational all the same save the hard drive from the compromised system so you can mount it and inspect its contents from another.. something that can be learned by doing forensics on the compromised data you might find that the compromise happened months earlier..
How can we create a fairly secure password hash in PHP? http://stackoverflow.com/questions/6340105/how-can-we-create-a-fairly-secure-password-hash-in-php thus ensuring that the only way security will be compromised is through my own error in coding EDIT Upon reading all of your.. cost for generating rainbow tables your security is still compromised. A few pointers Do NOT use a single salt for all passwords...
Alternative to SSL - “Manual” Encryption? http://stackoverflow.com/questions/6658557/alternative-to-ssl-manual-encryption want Perfect Forward Secrecy so that once a key does get compromised the attacker would not be capable of decrypting any past data...
How to best store user information and user login and password http://stackoverflow.com/questions/947618/how-to-best-store-user-information-and-user-login-and-password different table from the login. If one database table is compromised it's not a large leap to access another table in that same database...
|