Hello!
Urm...introductions?
22 yr old bloke who's been using Cal's knowledge (met him via the infamous b3ta) to expand my knowledge of my current biggest hobby (web development) and my university project abit! (Website (NOT NETWORK) security!)
Posted by
Sul, 08:25, 6th January 2004:
Hi!
21yo m wltm f 16-40 w/gsoh
Posted by
cal, 09:30, 6th January 2004:
stfuyfm hth hand
are you the gav who was asking about the beta login system a while ago then?
indeed i am Cal! Thanks for the advice mate, it really has been invaluable too me!
I've got my own login system working on a similar premesis now (although still having issues creating a random session id....anyone?)
Posted by
cal, 11:37, 6th January 2004:
what language, and what kind of unique id (numerical, hex, alpha, etc)?
Sorry, yeah I should say what my current ideas are really!
idea 1 is to create a loop to make a string of 16 chars with each letter randomally created by choosing a number between a and z ascii chars and converting to ascii.
idea 2 is to md5 a random 10 digit (or so) number and use the hash as the session id.
This would be in PHP and I'm worried about the 2nd coming up with stupidly long sessions and failing and the 1st being abit to heavy on the system. So any ideas/comments would be much appreciated!
I think Im going to go with a pure ASCII (alpha) random ID as its easier (for me) to store in a cookie ect. I should probably come up with a system so I can handle SQL indexing better, but that just confuses me more.
oh dear....I really do have alot to learn don't I?
Anyway, I've implemented the MD5 method, so I'll see how that goes, since the hash is 32 bytes each time it actually makes the whole thing abit neater, I've just got to work out how on earth to add a check digit to it now!
Posted by
cal, 13:25, 6th January 2004:
check? you want to ensure the session is a valid one? surely looking it up in the database to see if it exists would be fine.
as for generating a unique id:
function gen_session($len){
$buffer = '';
for($i=0; $i<$len; $i++){
$buffer .= chr(ord('a')+rand(0,25));
}
return $buffer;
}
unless you want numbers in there too. not intansive at all. a neat way to cheatily generate big not-as-random numbers is:
$buffer = rand(1000,9999).rand(1000,9999).rand(1000,9999).rand(1000,9999).rand(1000,9999);
:)
Posted by
cal, 13:27, 6th January 2004:
if you do actually need to do a check bit though, i'd use crc32 like this:
function get_crc_digit($str){
return crc32($str) % 10;
}
then use it like this:
$session .= '.'.get_crc_digit($session);
and then on the other side you check it like this:
list($session, $check) = explode('.', $session);
if ($check != get_crc_digit($session)){
die("Bad session!");
}
Posted by
cal, 13:30, 6th January 2004:
disclaimer: code was typed straight in and not actually checked or anything :)
Basically as far at the second way goes (rand.rand.rand.rand) thats how I had the system working; but I realised that using characters would make it seem more confusing (for hackers) and would give me ALOT more possible values in a shorter string (I'm thinking of the cookies more than perl here)
I thought about the 1st way (although it would have taken me 10 lines to do the same thing) I think I'm going to mention all three ways in my project anyway, but I basically have to choose the best.
As far as the crc check goes, even after seemingly searching alot fot it the crc funtion never came up anywhere at all, so beyond thanks for that its close to perfect, I think I might have to do some kind of calculation on the session first possibly so it makes it more complicated, but it should definitly help me lots!!
Oh and the idea is that the session expires on the server and not on the cookie, so I can tell (hopefully) between users who just haven't closed their browser and come back to the site from the people that have tried to edit their cookie to get unauthorised access.
Anyway...basically Cal, you are a god!! And I owe you at least one beer on the 13th of Feb! You can't believe how much you have helped me!
Posted by
cal, 15:12, 6th January 2004:
the cookie spec says that all browsers have to provide at least 1024 bytes of space (cookies longer than that may be truncated, and after you go past 8k, the default apache compile will barf at oversized headers). so you can make a 1000 character session and not break the browser. of course, it's nice to keep the session under 255 chars so you can stash it in a VARCHAR field.
as for the 13th, i wont be there as i'm in san diego for etcon
Ah right! I've been reading up on the w3 specs alot recently, theres just so much to get through and so much to learn I haven't had the chance! I think I'm going to definitly be storing it in a vchar anyway!
Shame we won't be seeing you on the 13th, but etcon...bleeding hell, can't be bad!! Still my dream to goto e3 but still can't see that happening for a while!
By the way, does anybody know what the IT (web development) industry in Spain is like? Either for a full time job or to start a company?
Posted by
cal, 15:51, 6th January 2004:
i *might* be presenting at etcon, though i think i might get out of that.
e3 would FUKCING ROCK.
don't know anything about the web market in spain though
bloody hell! Do it Cal! DOOO it!!!
e3 would REALLY rock, I'm STILL going to do it one year, I've promised myself!!
I think Im going to move there anyway, gets me out of the drizzle of Manchester!
Posted by
Brock, 16:09, 6th January 2004:
Mate of mine used to live in Spain and still has some contacts there. He does domain selling and stuff, and has a shed load of really good Spanish ones that he bought about 5 years ago. He is still sitting on them cos the industry (and resulting gold rush!) for internet there is struggling. They are not caught by the bug yet, basically.
If you could afford a few lean years, you could probably get a decent market leading stance in some areas, but I am not sure how long you'd have to wait before placing an order for your Ferrari...
Posted by
cal, 16:10, 6th January 2004:
gav: i've approved your account now so you can post in the other forums too
Posted by
Sul, 16:12, 6th January 2004:
It took Gav all that Cal-Worshipping yet you've approved people quicker through a pun. Its a mad mad mad mad mad mad world.
Welcome Gav
haha! Puns are good, I don't know if Cal trusts me not to fly through every post asking him for php help! But I'm slowly getting there now...some of these Journals are quite interesting really...apparently Tesco used their own security system which didn't use SSL or any client side downloads (or Java) so urm...Javascript then? Nice and secure for credit cards!
Anyway, thanks for the approval and help Cal, and thanks for the welcome Sul!
Im thinking of moving to spain for maybe 2 years and thats it, depending how things go of course. I'd just want money to live, and not alot more. I'd prefer to stick to web development or something in some form, but failing that its probably a bar job!
Posted by
cal, 16:27, 6th January 2004:
only took so long because he didn;t actually ask to be approved at any point. only just noticed this was in intros
I suppose this is the new thing now isn;t it?