« first day (858 days earlier)      last day (4102 days later) » 

11:00 PM
He digs phones and shit
 
unless using mt_rand() to append 26 characters is cryptographically secure, no
 
@Chris Yes you'r right. But im just try to fix a bounch of bugs like this to keep of from malicious inputs. like <>-s
 
but i just noticed that i basically never see bcrypt style hashes for websites
 
bcrypt should be fine. Are you also storing series? @ErikDolor
 
in the cookies, that is
 
11:01 PM
@ErikDolor no, no that most certainly isn't. use the openssl extension or /dev/random
or use @ircmaxell's randomlib
 
The only thing I know about phones is that I don't know anything. Oh... one more thing: if you backfeed a 220v generator into one of those roadside boxes full of punch-down blocks, the police come. And they take your generator.
 
@Lusitanian nice tips, didn't know about those.
@PeeHaa i'm not
I am however regenerating it every login, shouldn't that be enough? It also breaks the hijacked authentication cookie, right?
 
@Chris Errr... both lol and wut. lolwut, if you will.
 
@DaveRandom I was a precocious child. That's the word they used when I was in earshot, anyway. :p
 
11:03 PM
The top approach is what i'm currently doing
 
@ErikDolor Hey it's called improved for a reason ;)
 
though I always have 1 valid authentication token per user at most
 
@PeeHaa The recent breech in Yahoo Mail was related to this type of attack.
 
wait, that's what happens in the top approach..
 
@Chris That was indeed a combination of this and a huge fucking fuckup
 
11:05 PM
but the only real difference here is that the user is notified of the likely hack, right?
 
"Yahoo mail", incidentally, explains the whole thing
 
hi guys
 
they've had so many security issues over the years you'd think it was written on rails
 
i want to compare
if(($amount=='' || !is_numeric($amount) || $type =='')) && (var_dump(&type) < 46))$validation.=' Enter all required fields \n';
this is giving me error
 
@ErikDolor That and the possibility to invalid the tokens when there is a breach
 
11:05 PM
LOL, they got into George W. Bush's Yahoo account, and apparently found a self portrait: deathandtaxesmag.wpengine.netdna-cdn.com/wp-content/uploads/…
 
type is coming from db...i am comparing it with 46
 
hmm, good point... still, if the hacker acquired all the user's cookies and the user logs in before the hacker can use those cookies, wouldn't the same happen? You get notified of a hack that happened, even though the hacker didn't get in?
 
@PeterJennings What on earth is that var_dump() supposed to do?
 
@DaveRandom undefined constant type: assuming "type" :D
 
i used this example
var_dump("something" == 0);
3
Q: Weird PHP String Integer Comparison and Conversion

maurisI was working on some data parsing code while I came across the following. $line = "100 something is amazingly cool"; $key = 100; var_dump($line == $key); Well most of us would expect the dump to produce a false, but to my surprise the dump was a true! I do understand that in PHP there is t...

 
11:10 PM
That's nothing to do with a logical comparison you'd actually use in an application, var_dump() is for debugging things only
 
can i do like this
if(($amount=='' || !is_numeric($amount) || $type =='')) && ((int)(&type) < 46))$validation.=' Enter all required fields \n';
type casting...
 
I presume that & is just a typo for $?
At the moment you probably have a parser error
Although also that logic isn't right
And you should take a look at empty()
 
And operator..
 
@ErikDolor
 
& in PHP does 1 of 3 things:
 
11:11 PM
> One possible solution to this problem is to treat the presentation of an invalid login cookie as evidence of a previously successful attack. The site could then present an impossible to miss security warning and automatically invalidate all of the user's remembered login sessions. This approach would create a denial of service attack: since usernames are easy to come by or guess, an attacker could submit invalid login cookies for every user and thus disable the entire system.
 
if(($amount=='' || !is_numeric($amount) || $type =='')) && (((int)($type)) < 46))$validation.=' Enter all required fields \n';
 
&& is a logical and
& is a bitwise and
&$var is pass by reference
 
and &&&, a little known operator, is an illogical and
 
none of those three things apply to what you are doing
 
ah, now i see. Now i got my head wrapped around it. Thanks for the help :)
 
11:13 PM
np
 
type is actually a dropdown...those values come from db
 
wait, actually not. that cookie is still invalidated as soon as the actual user logs in normally, right? So is the token only disabled to prevent the case where the user does not log in right away?
 
@PeterJennings The logic isn't right but you're closer. What you want to check is that $amount is numeric and $type is greater than or equal to 46
 
because if he does log in anyway, the hacker's token will be disabled too.
Or is it done in case all tokens are compromised?
 
When you translate that english into code it looks like is_numeric($amount) && $type >= 46
And if you want to negate it, you are checking that $amount is not numeric or $type is less than 46
 
11:15 PM
@DaveRandom Your English sucks
 
ctype_digit((string) $amount)
 
...which looks like !is_numeric($amount) || $type < 46
 
user must choose one item in drop down and must enter amount
 
@PeeHaa I hav no idya wot your torking abowt
 
omg u geeze r sooo wierd
 
11:17 PM
@ErikDolor exactly
 
Ah, then my initial thought process was actually right, i just forgot about the tiny little problem of a completely compromised database or stupid users :)
 
What about a stupid database and compromised users?
 
Last week somebody "migrated" a database and it set ALL THE THINGS to MyISAM.
Now that's a stupid database
Unless disk space in your thing of course ;)
 
MyISAM? :(
 
Nice :P
 
11:21 PM
Who needs constraints anyway right?
 
Aahhh, that rarely used definition of "migrated" that means "bent over and violated unforgivingly"
 
hehehe
 
Not making promises on fixes, but let me see whether I can reproduce
 
cool :)
i quite possibly somehow broke oauth2 whilst fixing oauth1
lol
 
11:23 PM
You can't have both
Add that to the readme :P
 
LOL right, use oauth1-broken branch or oauth2-broken branch :D
 
loool
 
woot
Fucks are always good
 
indeededly
 
11:29 PM
It can be good, and fucking good, can't get better than that.
 
lol, yes you can....
 
I just wrote this:
<?php

class Object implements Countable, IteratorAggregate {
    private $size = 0;
    private $data = [];

    function __construct() {
        $this->size = func_num_args();
        $this->data = array_combine(
            func_get_args(),
            array_fill(0, $this->size, NULL)
        );
    }

    function __get($item) {
        if (!array_key_exists($item, $this->data)) {
            return NULL;
        }
        return $this->data[$item];
    }

    function __set($item, $value) {
How can I make more MVC-like OOP?
 
@Lusitanian woah crash and burn. /investigating
 
@LeviMorrison You think it can?
 
Hey guys, quick question

Is it possible to pull the 404 destination (specified in an htaccess file), using cURL?
 
11:38 PM
That's a silly question, rephrase it. (Try again, as seen in video games)
 
you have morphed into a blue stick figure
 
I'm trying to extract it in PHP/cURL. I've been looking through the headers and I'm not seeing it
 
lol
 
@Batfan Paste the damned URL.
 
@webarto The URL is unimportant. Any non-existant page can be used, as long as the domain is valid and there is an .htaccess file on the server, specifying a 404 error doc. If you need something to test, you can give this a whirl --> macombcountydentaloffice.com/fakepage.html
 
11:45 PM
@Batfan And you want to fetch the HTML of that page? How do you know there .htaccess, first does it exists, second, is it Apache?
 
@webarto This is a server I've worked on so, I can confirm this site is using htaccess and is on Apache. I'm not trying to get the HTML. I'm trying to obtain the URL of the page that's being served as the 404 page
 
> Your unique google user id is: *****5155205967691779 and your name is Yadeo Bloug
@Lusitanian
 
@PeeHaa <3
 
@Batfan You can't do that.
 
Now let me actually read the ticket and see what OP meant :P
 
11:48 PM
kk
 
curl -iL --head macombcountydentaloffice.com/fakepage.html
HTTP/1.1 404 Not Found
Date: Wed, 20 Feb 2013 23:48:24 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Mon, 18 Feb 2013 19:07:16 GMT
ETag: "7ecbd0-3f4d-4d6046eebc100"
Accept-Ranges: bytes
Content-Length: 16205
Content-Type: text/html; charset=UTF-8

curl -iL --head macombcountydentaloffice.com/.htaccess
HTTP/1.1 403 Forbidden
Date: Wed, 20 Feb 2013 23:48:53 GMT
Server: Apache/2.2.3 (CentOS)
Content-Type: text/html; charset=iso-8859-1
 
@webarto Hmm, okay. That's the conclusion I've been coming to. Thought maybe there was something I was missing
 
@Batfan
@Batfan Some servers (per instruction) redirect to something like /404 page, instead of serving on the same URL.
 
@Lusitanian I don't really get it. I had to change the path param for the request to implement The UriInterface to prevent it bitching about not being able to get the baseuri, But besides that it works for me
 
@webarto Right. I'm trying to setup a test to check to make sure that a specific page is being served for 404 errors.
 
11:51 PM
@PeeHaa weird. guess i didn't break it, that means
 
hello all
 
@Lusitanian But shouldn't the examples pass an uriinterface instance here: github.com/Lusitanian/PHPoAuthLib/blob/master/examples/… instead of a string
 
@Batfan That doesn't sound hard thing to do. If you have the 404 page, you can compare, if you don't have it, you can try non existing URL and check if return is servers default 404 page, or something yours, etc. Not really sure what you want (exactly).
 
@Lusitanian Think I see what OP did wrong
> Fatal error: Uncaught exception 'OAuth\Common\Http\Exception\TokenResponseException' with message 'file_get_contents(accounts.google.com/o/oauth2/token): failed to open stream: HTTP request failed! HTTP/1.1 400 Bad Request
 
@webarto Unfortunately, this needs to work on a number of different sites (different content), all of which use the homepage for their 404 (not my choice).
@webarto Sounds like my only option is to grab the full code from both pages and compare them, before returning a result
 
11:56 PM
@Batfan Fetch the homepage and some 404 URL, yup... although that could be a mess, because of HTML. You might want to extract some index page specific part, and compare it to 404.
 
God did I already mention that nginx >> apache?
 
@webarto That's the route I'll go then. Thanks man
 
Yeah I used two greater thans. Eat it
 
@PeeHaa Much greater? :P It is.
 
:D
 
11:58 PM
@webarto Good point. I'll keep that in mind. Thanks
 
ur welcom, as they say.
 

« first day (858 days earlier)      last day (4102 days later) »