Digital Paint Discussion Board

Development => General Development => Topic started by: jitspoe on June 12, 2006, 07:24:58 PM

Title: Secure PHP Logins
Post by: jitspoe on June 12, 2006, 07:24:58 PM
I'm going to need to create a web frontend for managing clans and whatnot with the global login system.  I've never done anything related to logins or security with PHP, so I'm a bit in the dark here.  A quick google search turns up this: http://www.devshed.com/c/a/PHP/Creating-a-Secure-PHP-Login-Script/  Would that be sufficient?  Better yet, is there some kind of already-functional base code I could work off of?
Title: Re: Secure PHP Logins
Post by: Smokey on June 12, 2006, 09:02:18 PM
when i was learning php and needed to figure out how to do a login syste, http://evolt.org/node/60265 helped me alot
you can probally just modify it. for any help you can ask me, or im sure jesse wouldent mind =]
Title: Re: Secure PHP Logins
Post by: jitspoe on June 12, 2006, 10:39:38 PM
That example, like most I've seen, sends the password in plaintext.  It doesn't "encrypt" it until it reaches the server.  That's really almost pointless.  All it does is prevent somebody with just access to the database from obtaining your password.  Anybody with a packet sniffer anywhere along the lines can nab it.

The only way I can think of to prevent that is a) use https, or b) use some javascript encryption algorithm.  They both accomplish the same thing, more or less, but https is kind of a pain because it makes browsers pop up all kinds of security info.  Though... some might find that useful.  *shrug*
Title: Re: Secure PHP Logins
Post by: XtremeBain on June 12, 2006, 10:51:18 PM
Just have a company sign your SSL certificate.
For comparison goto http://whichssl.com/index.html

Javascript encryption works too, and is cheap ;).  Include a js md5 function from somewhere online.  "Salt" the string that you're encrypting with md5() in the javascript, then salt the incoming md5 with something secret within the web-app.
Title: Re: Secure PHP Logins
Post by: bug on June 13, 2006, 07:49:29 AM
Oy! I built my entire website from scratch with PHP/JavaScript... it's like this topic was made for me! Anyway, for JavaScript encryption, check out some of these links:

http://home.versatel.nl/MAvanEverdingen/Code/
http://www.movable-type.co.uk/scripts/TEAblock.html
http://pajhome.org.uk/crypt/md5/
http://www.fourmilab.ch/javascrypt/
http://www.blingo.com/search?q=javascript+encryption&sourceid=firefox&s=0&s=0

P.S.
I like coding PHP. Hint, hint.
Title: Re: Secure PHP Logins
Post by: TinMan on June 13, 2006, 11:35:18 AM
I like exploiting php, so once you're done I'll put it to the test for ya.  :)
Title: Re: Secure PHP Logins
Post by: jitspoe on June 13, 2006, 01:31:00 PM
While MD5 is probably sufficient, Javascript RSA (http://www.ohdave.com/rsa/) almost seems too clever to pass up.
Title: Re: Secure PHP Logins
Post by: Smokey on June 13, 2006, 02:19:28 PM
very nice, but for ease, i would use md5. Also, php designer 2005 or notepad++ would help you code it :)
Title: Re: Secure PHP Logins
Post by: bug on June 13, 2006, 03:19:24 PM
I would suggest Programmer's Notepad (http://pnotepad.org)
Title: Re: Secure PHP Logins
Post by: TinMan on June 13, 2006, 03:28:09 PM
I would suggest vi, but I'm just a *nix sexually promiscuous person...
<--edit--> word filter in pink, Jits, your filters are hilarious, lol
also, gedit can be very sweet when you enable some plugins and kill the wordwrap
Title: Re: Secure PHP Logins
Post by: jitspoe on June 13, 2006, 07:47:00 PM
Hehe, I don't think the editor makes that much of a difference (unless it has something really handy like MSVC's intellisense).

I'm not sure if this is exactly what Bain was suggesting or not, but here's what I'm thinking if we go the MD5 route:

- Password hash stored on the server as MD5(salt+pass).
- When generating the login page, the server creates a random string (I think you can handle this with a session, but I'm not sure -- never used sessions before).
- User enters password into form, javascript hashes password as MD5(random+MD5(salt+pass)).
- Server compares that to MD5(random+stored_hash).

While probably not as secure as RSA, it should be sufficient enough to stop people from sniffing a reusable MD5 hash and logging in.  The only downside is that the salt string can't be kept secret.
Title: Re: Secure PHP Logins
Post by: Smokey on June 13, 2006, 07:52:49 PM
do you need javascript to hash the md5? $md5() does it correct?
Title: Re: Secure PHP Logins
Post by: jitspoe on June 13, 2006, 08:02:19 PM
$md5() does it in PHP on the server.
Title: Re: Secure PHP Logins
Post by: Eiii on June 13, 2006, 08:05:06 PM
While probably not as secure as RSA, it should be sufficient enough to stop people from sniffing a reusable MD5 hash and logging in.  The only downside is that the salt string can't be kept secret.

You could have the 'salt string' be a random number based off of the current date, GMT.
Title: Re: Secure PHP Logins
Post by: TinMan on June 13, 2006, 08:08:44 PM
This new login system could use GUID's like those of Quake 3, Wolf:ET, and various other games, this could be hashed and used in the login too.
Title: Re: Secure PHP Logins
Post by: supertanker on June 13, 2006, 08:15:36 PM
I know something about PHP, and alot about sessions.

I can help if u need...
Title: Re: Secure PHP Logins
Post by: TinMan on June 13, 2006, 08:21:41 PM
Jits, try to make the login like temporarily ip based, or have some really strong cookie setup, otherwise people might just send other players links to cookie grabbers and then they'd have their cookie.
 (http://img161.imageshack.us/img161/5298/pdmtses00489tg.jpg)
Title: Re: Secure PHP Logins
Post by: XtremeBain on June 14, 2006, 09:47:41 AM
$md5() does it in PHP on the server.
No.  $md5() does it in mIRC, md5() does it in PHP.
Title: Re: Secure PHP Logins
Post by: jitspoe on June 14, 2006, 12:38:04 PM
Whoa, mirc has an md5 function?

TinMan: Don't cookies have to be from the same domain to work?  Or is that security only available in certain browsers?
Title: Re: Secure PHP Logins
Post by: bug on June 14, 2006, 01:00:51 PM
It's a browser-specific security setting I believe, and setting the domain for a cookie is only an optional step in writing a PHP cookie (you can assign domainless cookies). Using PHP's session functions (http://us2.php.net/manual/en/ref.session.php) over a home baked cookie the best way to go.
Title: Re: Secure PHP Logins
Post by: TinMan on June 14, 2006, 03:50:37 PM
Well this (http://www.criticalsecurity.net/index.php?showtopic=7137) is a common way that cookies are dropped from the client's browser, so read into it this for seeing how the cookies are stolen and how they can be used, also, check out some more stuff on the Critical Security forums (http://www.criticalsecurity.net/), they probably have lots of info that will be helpful on making your login script.
Title: Re: Secure PHP Logins
Post by: Qoo on June 14, 2006, 03:58:17 PM
I post on cs wow.


If you just keep the login page and the authed areas simple everything should be ok, less variables mean less chance to inject code and perform XSS to steal the cookies.
Title: Re: Secure PHP Logins
Post by: TinMan on June 14, 2006, 04:06:46 PM
I need to buff up on my stuff and get back to my HTS challenges sometime toon, lol
http://www.hackthissite.org/user/view/th3t1nm4n (http://www.hackthissite.org/user/view/th3t1nm4n)
Title: Re: Secure PHP Logins
Post by: Qoo on June 14, 2006, 04:23:47 PM
Well you can try - some of the realistic ones are down now I think. 
Title: Re: Secure PHP Logins
Post by: Smokey on June 14, 2006, 05:02:25 PM
im confused on challange 4...
Title: Re: Secure PHP Logins
Post by: TinMan on June 14, 2006, 06:21:03 PM
http://www.criticalsecurity.net/index.php?showtopic=8 (http://www.criticalsecurity.net/index.php?showtopic=8)
There's a firefox extension called "Web Developer" or something like that which is useful for the live html editing missions.