3 ms·
Err, no, I'm not talking about a timing attack. <?php $a = md5('240610708'); $b = md5('QNKCDZO'); echo "$a\n"; echo "$b\n"; echo "
by sarciszewski 12y ago
Err, no, I'm not talking about a timing attack.
<?php
$a = md5('240610708');
$b = md5('QNKCDZO');
echo "$a\n";
echo "$b\n";
echo "\n";
var_dump($a == $b);
Run that code.
Then change the == to an === and observe the difference.
- sarciszewski 12y agoAlso, not sure if I actually have to mention Matasano in a post to get you to see this, but it'd be great if you could link to a blog/github/Twitter/something on your HN profile. :)
- jerematasno 12y agoWow, the level of crazy there is very high. Up until today I thought that PHP was fine, but nobody should ever use it for anything remotely real. You have changed my mind. We must kill PHP with fire.
- sarciszewski 12y agoPHP offers hash_equals() since 5.6 and password_hash()/password_verify() since 5.5 (and === in all versions) -- this is a problem that plagues poorly designed legacy code. The problem is not PHP, the problem is ignorant developers who do not know [how] to use password_hash() and password_verify(). [Also, "Matasano". I feel like I'm pressing the summonthensa.com button but w/e.]
- jerematasno 12y agoI'm going to have to disagree. Any programming language where string comparison works "normally" for everything except for certain magic string values is Wrong. Like, I see where they're going with it, but it's probably a source of undetected Heisenbugs on a significant proportion of PHP sites. Not just talking about password hashes and other security critical operations here, just good old bugs.