4 ms·

Link is four oh four, but I assume you're talking about a string comparison timing attack? Those don't really work over a network on modern hardware. Most strin

Link is four oh four, but I assume you're talking about a string comparison timing attack? Those don't really work over a network on modern hardware. Most string comparison functions actually compare words (8 bytes), and string comparison increases faster over the years than network latency. For more info see the Time Trial paper by Daniel Mayer and Joel Sandin ( https://www.blackhat.com/docs/us-14/materials/us-14-Mayer-Time-Trial-Racing-Towards-Practical-Timing-Attacks.pdf https://www.blackhat.com/docs/us-14/materials/us-14-Mayer-Ti... / http://matasano.com/research/TimeTrial.pdf http://matasano.com/research/TimeTrial.pdf / https://github.com/dmayer/time_trial https://github.com/dmayer/time_trial )

sarciszewski 12y ago
Err, no, I'm not talking about a timing attack. <?php $a = md5('240610708'); $b = md5('QNKCDZO'); echo "$a\n"; echo "$b\n"; echo "\n"; var_dump($a == $b); Run that code. Then change the == to an === and observe the difference.
- sarciszewski 12y ago
  Also, not sure if I actually have to mention Matasano in a post to get you to see this, but it'd be great if you could link to a blog/github/Twitter/something on your HN profile. :)
- jerematasno 12y ago
  Wow, the level of crazy there is very high. Up until today I thought that PHP was fine, but nobody should ever use it for anything remotely real. You have changed my mind. We must kill PHP with fire.
  - sarciszewski 12y ago
    PHP offers hash_equals() since 5.6 and password_hash()/password_verify() since 5.5 (and === in all versions) -- this is a problem that plagues poorly designed legacy code. The problem is not PHP, the problem is ignorant developers who do not know [how] to use password_hash() and password_verify(). [Also, "Matasano". I feel like I'm pressing the summonthensa.com button but w/e.]
    - jerematasno 12y ago
      I'm going to have to disagree. Any programming language where string comparison works "normally" for everything except for certain magic string values is Wrong. Like, I see where they're going with it, but it's probably a source of undetected Heisenbugs on a significant proportion of PHP sites. Not just talking about password hashes and other security critical operations here, just good old bugs.

sarciszewski 12y ago

Err, no, I'm not talking about a timing attack. <?php $a = md5('240610708'); $b = md5('QNKCDZO'); echo "$a\n"; echo "$b\n"; echo "\n"; var_dump($a == $b); Run that code. Then change the == to an === and observe the difference.

sarciszewski 12y ago
Also, not sure if I actually have to mention Matasano in a post to get you to see this, but it'd be great if you could link to a blog/github/Twitter/something on your HN profile. :)
jerematasno 12y ago
Wow, the level of crazy there is very high. Up until today I thought that PHP was fine, but nobody should ever use it for anything remotely real. You have changed my mind. We must kill PHP with fire.
- sarciszewski 12y ago
  PHP offers hash_equals() since 5.6 and password_hash()/password_verify() since 5.5 (and === in all versions) -- this is a problem that plagues poorly designed legacy code. The problem is not PHP, the problem is ignorant developers who do not know [how] to use password_hash() and password_verify(). [Also, "Matasano". I feel like I'm pressing the summonthensa.com button but w/e.]
  - jerematasno 12y ago
    I'm going to have to disagree. Any programming language where string comparison works "normally" for everything except for certain magic string values is Wrong. Like, I see where they're going with it, but it's probably a source of undetected Heisenbugs on a significant proportion of PHP sites. Not just talking about password hashes and other security critical operations here, just good old bugs.