I've just landed a PHP5 gig. I won't be handling the parts of the application that involve super sensitive data, but I still know embarrassingly little about security and encryption methods. I only know the very basics (don't store passwords in plaintext, don't allow users to run code using post data, etc). What do I need to know to keep my applications secure, and where can I learn it?
11 Answers
Learn the difference between hashes and encryption. Encryptions are generally two-way interpretations of a string. I can encrypt my password, and then decrypt it to plaintext again. The idea behind hashes are that they become a one-way 'encryption.'
On my sites I store passwords as hashes. Anytime a user signs on, I re-hash their provided password, test it against the hash stored in the database and approve if they match. I cannot send them their password if they forget it, since (generally) there is no way for me to know.Two different strings can translate into the same hash, which makes it (generally) impossible to find out what the original string was.
This is one issue that is good to get a firm understanding of, and discern when to use encryption vs. hashes.
Know not to write your own encryption functionality. An existing, trusted library is best way to go wherever possible. Avoid cool, bleeding edge technologies that lack many successful programmer-hours and user-hours behind them. Know not to trust the functionality you choose until you've thoroughly tested it yourself, first-person. Keep abreast of new developments which may antiquate your chosen functionality overnight. Know that just because you're using the best encryption technology available today that you've protected nothing if you leave the keys on the table (e.g., cleartext is not in a cache or stored in another table in the same database, private keys not left in the open)
- Understand the difference between encrypting and hashing
- Understand the reason for salts
- Understand that HTTP is cleartext
- Understand what HTTPS is
- Understand that you will never (almost never) be able to create better hashing or encryption methods than what 3rd party libs and built-in libs already do
That technology is not the weakest link in security.
The short answer
You can never be too secure
Use Salted Password Hashing for increased security
The longer answer (still not complete, though)
Security is not something to be learnt by a quick tutorial on the web. It requires in-depth knowledge of not only what vulnerabilities exist, but WHY they exist and HOW they work. One of the biggest problems (especially in open source), is that new methods are added all the time, therefore we must understand security concepts and theory.
Read books, take classes, and test the vulnerabilities yourself on a local machine. Then you'll slowly begin to grasp the concept behind how to secure a web application.
Check Out the following to start you off
Please pay attention to following points when you store passwords,
Hashed password is generally more secure because you don't have to keep a secret. However, it prevents you from using other hash-based scheme in your authentication flow. For example, you can't use HTTP Digest authentication with hashed password.
Simple hash is prone to rainbow table attak (http://en.wikipedia.org/wiki/Rainbow_table). Please add a non-reoccuring nonce to the hash or use the nonce as the key to HMAC. The nonce needs to be stored with the passwords. I prepend it to the digest.
If encryption is used, make sure a random Initial Vector is used so same password will be encrypted to different ciphertexts for different user. Otherwise, you are prone to pattern matching attack. MySQL has built-in encryption command. It doesn't inject IV so never use it for passwords.
Save key name/version with the ciphertext so keys can be rotated. Key-rotation is required for compliance with certain standards. Encryption without key information is impossible to decrypt when you are forced to change or rotate keys.
If you follow these advices, your passwords will be safe with any encryption/hash schemes.
Check out the Open Web Application Security Project. They have a lot of information on the current web app security issues and what you need to do to defend against them. OWASP is putting together a Development Guide that provides a lot of good information on web apps and web services development issues.
If you're looking at it from a PHP context, I'd recommend this book:
The thing I really like about this book is it covers much more than just a list of the security-related functions in PHP. A large part of it covers general web security concepts and protection mechanisms. Permissions, principle of least privilege, encryption, hashing, cross-site scripting, cross-site request forgeries, session hijacking, etc. are all covered here, with examples of writing secure code in PHP.
Having taken graduate-level security classes in college, I'm impressed with the coverage in this book. I'd consider it required reading for any professional PHP developer.
First you have to get familiarized with this php methods:
Here you have all cryptography extensions in PHP.
Related