Re: reviewing random seeding
"Thijs Kinkhorst" <[email protected]>
| Newsgroups | gmane.mail.squirrelmail.devel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, August 21, 2008 13:18, Paul Lesniewski wrote: > OTOH, as long as admins know it is weak, then we've done our part, and > having the weak algorithm does discourage amateur hackers. What about > replacing with a known better algorithm? Isn't there somewhere we are > using something better? The problem is dat the encrypted password is stored in someone's pref file and there's no real way to store that individual's encryption key other than also in pref files or things similarly readable for those reading the pref files. As said defence against such amateur hackers that they can't decrypt something given the ciphertext, key and algorithm is not useful and only distracts from the fact that the store is actually unprotected. >> 2) php_combined_lcg() in global.php seeds the random number generator >> in a not so secure fashion. >> >> I believe we should just rip out this seeding and replace it with a >> call to sq_mt_randomize() instead so we have this code only in one >> place. > > Sure, seems OK. It was probably put there because that section is a > direct rip (apparently) from Gallery. Ok. Thijs ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: [email protected] List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel