Re: reviewing random seeding

"Thijs Kinkhorst" <[email protected]>
Newsgroups gmane.mail.squirrelmail.devel
Message-ID <[email protected]>
On Thu, August 21, 2008 13:18, Paul Lesniewski wrote:
> OTOH, as long as admins know it is weak, then we've done our part, and
> having the weak algorithm does discourage amateur hackers.  What about
> replacing with a known better algorithm?  Isn't there somewhere we are
> using something better?

The problem is dat the encrypted password is stored in someone's pref file
and there's no real way to store that individual's encryption key other
than also in pref files or things similarly readable for those reading the
pref files.

As said defence against such amateur hackers that they can't decrypt
something given the ciphertext, key and algorithm is not useful and only
distracts from the fact that the store is actually unprotected.

>> 2) php_combined_lcg() in global.php seeds the random number generator
>> in a not so secure fashion.
>>
>> I believe we should just rip out this seeding and replace it with a
>> call to sq_mt_randomize() instead so we have this code only in one
>> place.
>
> Sure, seems OK.  It was probably put there because that section is a
> direct rip (apparently) from Gallery.

Ok.



Thijs


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.