paragonie-scott

<?php

$publicKey = openssl_pkey_get_public('
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7o9A47JuO3wgZ/lbOIOs
Xc6cVSiCMsrglvORM/54StFRvcrxMi7OjXD6FX5fQpUOQYZfIOFZZMs6kmNXk8xO
hgTmdMJcBWolQ85acfAdWpTpCW29YMvXNARUDb8uJKAApsISnttyCnbvp7zYMdQm
HiTG/+bYaegSXzV3YN+Ej+ZcocubUpLp8Rpzz+xmXep3BrjBycAE9z2IrrV2rlwg
TTxU/B8xmvMsToBQpAbe+Cv130tEHsyW4UL9KZY1M9R+UHFPPmORjBKxSZvjJ1mS
UbUYN6PmMry35wCaFCfQoyTDUxBfxTGYqjaveQv4sxx0uvoiLXHt9cAm5Q8KJ+8d

paragonie-scott

I want to build an app that stops harassment and other forms of unsolicited bullshit.

• I don't want any money for it.
• I don't want to serve ads.
• I just want it to perform one simple task and get out of the user's way.

Goal

A mobile app (Android and/or iOS) that only allows trusted callers to go through.

paragonie-scott

Via Twitter

Authors consider SQLi as main attack vector. Hashed token mitigate r/o SQLi, encrypted mitigate r/w SQLi

That actually doesn't buy you anything. Consider the following table schema:

CREATE TABLE reset_tokens (
    tokenid BIGSERIAL PRIMARY KEY,
 selector TEXT,

paragonie-scott

Update

Filed an issue to address this particular concern.

Thanks joepie91 for finding the folks responsible and getting the conversation started.

---

Currently, SVG is a security foot-cannon that allows attackers to upload a Stored XSS payload when a user views the image directly. Example.

paragonie-scott

Would you (or the company you represent) consider paying money for an extension/plugin for whatever platform you currently use that fixes security faux pas?

For example:

• WordPress doesn't securely store passwords.
• Drupal only uses emulated prepared statements.
• Magento has _____ (will fill in after it's public).
• Most CMS projects don't offer secure automatic updates. (WordPress's implementation is insecure. Drupal is working on it.)

paragonie-scott

Suppose I have a friend named Alice. Alice has registered to WhatsApp with a
Saudi number but resides in Europe. We chat over WhatsApp regularly. We are both
using the latest version of WhatsApp for Android (2.16.155).

However, Alice is unable to receive or initiate WhatsApp calls, even though she
is in Europe and is using European WiFi. If you can test this, I suggest you do.
Get a Saudi phone number, register to WhatsApp, and then fly to France and make
a call. You will encounter the same result even if you're on French WiFi.

WhatsApp claims that "the Saudis are blocking the initial handshake [for

paragonie-scott

function secure_rand(min, max) {
    var rval = 0;
    var range = max - min;
    if (range < 2) {
        return min;
    }

    var bits_needed = Math.ceil(Math.log2(range));
    if (bits_needed > 53) {
      throw new Exception("We cannot generate numbers larger than 53 bits.");

paragonie-scott

Changelog

• February 19, 2016: Initial release.

Broken?

GitHub Gist doesn't send notifications when people leave a comment, so shoot me an e-mail at admin@cryto.net. I'll gladly fix it. Fuck advertising.

paragonie-scott

Example code for How to Safely Store a Password in 2016.

paragonie-scott

Let's say you have a file like this:

<?php
declare(strict_types=1);

class Foo
{
    protected $x;
    public function __construct(array $x = [])