Beefy Boxes and Bandwidth Generously Provided by pair Networks
Keep It Simple, Stupid
 
PerlMonks  

Re^5: CGI MySQL insert/update special characters

by jcb (Parson)
on Mar 30, 2020 at 01:19 UTC ( #11114787=note: print w/replies, xml ) Need Help??


in reply to Re^4: CGI MySQL insert/update special characters
in thread CGI MySQL insert/update special characters

The problem with digest authentication is that it requires the server to store a plaintext password or password-equivalent and that leads to the server being a very attractive target for stealing the password list. (Windows networking has gone through several variants of this that all fall to "pass the hash" attacks. Then Microsoft started using Kerberos in Active Directory and screwed that up too, leading to the "golden ticket" and "silver ticket" attacks.)

I consider the house embedded device LAN an isolated network, since it does not cross with Internet-connected segments except at dual-NIC hosts (all of which are considered "secure" and none of which are configured to bridge LANs or route traffic) that are on both networks, nor are there any wireless APs on it, nor does it leave the building. Embedded devices often have really bad security anyway; I have worked with one embedded network stack that (unless I missed something in the code) used a 32-bit entropy variable for everything — including SSL session keys.

  • Comment on Re^5: CGI MySQL insert/update special characters

Replies are listed 'Best First'.
Re^6: CGI MySQL insert/update special characters
by haukex (Bishop) on Mar 30, 2020 at 07:24 UTC
    The problem with digest authentication is that it requires the server to store a plaintext password or password-equivalent

    Yes, good point as well. (I did say "at the very least" - but I should have made it clear that more advanced schemes would be much better.)

    I consider the house embedded device LAN an isolated network ... Embedded devices often have really bad security anyway

    Taking this point together with the above, I'm confused about the message, whether plaintext passwords are okay or not. When an embedded or proprietary device has limitations, then one might not be able to do anything about its security, sure. But anything else, personally I like to play it safe. And when it comes to recommendations to others, personally I'd very much avoid saying that plaintext passwords are okay (when they can be avoided, as in the context of this thread) - that's all I was trying to say.

      I'm confused about the message, whether plaintext passwords are okay or not.

      Then I will be more clear: plaintext passwords are NEVER acceptable across the open Internet.

      (And some embedded devices have "SSL" that is little better than plaintext anyway — if the RNG has only a 32-bit state variable, then 32 bits is probably the effective strength of the session key!)

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://11114787]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others examining the Monastery: (4)
As of 2021-04-19 05:24 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found

    Notices?