can perl help me with secure PIN management via database?

[jcsimba]

This node falls below the community's threshold of quality. You may see it by logging in.

[merlyn]

Untested code, derived from the DB_File::Lock manpage.

use DB_File::Lock;
tie(%db_hash, 'DB_File::Lock', "/path/to/my/database",  O_RDWR, 0600, 
+$DB_HASH, 'write') or die;
1 while $db_hash{my $num = get_random_number()};
$db_hash{$num}++;
  ... do something with $num ...
untie(%db_hash);

-- Randal L. Schwartz, Perl hacker
Be sure to read my standard disclaimer if this is a reply.

[jcsimba]

Thanks for the code snippet...unfortunately I'm a very green novice at this and whilst I'm not looking for total 'freebies' here I really don't know how to implement this into a script....any explanation would be most helpful! Also with the database file too (I know how to create a 'csv' file) but apart from that then...erh um!

[fokat]

Be sure to look for Authen::PIN, which can help you create those PIN numbers. I wrote it for a similar purpose.

You might also consider using Random.org's services, as they are an excellent source of random numbers. Just don't use the numbers as they come. You need to do a suitable transformation to keep the PIN numbers unrelated to the real random seed.

You should try to avoid storing the PINs in a database, though. Those numbers make for a very tempting target. What I ended doing in my implementation is to store the MD5 of those PINs. That makes the database worthless for an attacker. If it gets compromised, the attacker still does not know about the real PINs. Checking for a valid PIN is easy, as you can always re-calculate the hash from the original PIN and look for it in the database.

Best regards

-lem, but some call me fokat

[davorg]

How many of these are you going to assign each second? If it's one or less, then why not just use the current time. The number of seconds since Jan 1st 1970 currently contains 10 digits and you can get that using time.

--
<http://www.dave.org.uk>

"The first rule of Perl club is you do not talk about Perl club."
-- Chip Salzenberg

[jcsimba]

Hi Dave.. How many per second...well that is a bit unpredictable! possibly a number or just one! Not much help maybe I know... But this would be for a client who will be selling 'calling cards' online and after payment for such, a customer needs to a 'pin-number' (10 digits long) emailed to them or produced on their screen. But this can't be a random number other than one 'plucked' from a database or other type of file on the server (asny suggestions welcomed!) Any help Dave Thanks

[OM_Zen]

Hi ,



           use strict;
           use CGI;

           #use some mail module like MIME::Lite 

           open(Filenm,"filenames.csv") || die "the file is not ready 
+to be opened";

           while (<Filenm>){

              local $/;
              # Here the file's size is important, for a lesser size t
+his is ok

              my @pindigits = split(',',$_);
              $pinforphonecard = shift(@pindigits);

              #    have the cgi stuff and MIME::Lite or any that you u
+se for mailing part with the $pinforphonecard as the one to be let to
+ send 

              # then go ahead and remove the $pinforphonecard and a co
+mma from the file 

              $_ =~ s/$pinforphonecard,//g;
              last;

            }



You should actually go for Tie::Db... as Merlyn observes, as you insist on csv , you could do this way