OpenComment security: I need Your feedback

Thursday, 15 June 2006 20:49

I've tried to improve the security of OpenComment, and I want it to present it here, so You can give it look and have the chance to provide me feedback:

First I've create an Oracle with is creating highly depending oracleKeys (class OpenCommentSecurities)

Each oracleKeys create by the Oracle has the following properties:

oracleKeys returned are always MD5 encrypted
oracleKeys are depending of current date and time, server and user browser agent
oracleKeys can timeout

Here is the algorithm:

$key = session_id();
if(!$key){
     $key = $_SERVER['REMOTE_ADDR'];
}
$value = $key .
   $GLOBALS['mosConfig_absolute_path'] .
   $_SERVER['HTTP_USER_AGENT'] .
    date("F j, Y, g a");
return md5($value);

Security 1
All AJAX enable functions will test the oracleKey submitted by the browser, (can timeout!), so nobody should be able to make mass attack on OpenComment across multiple server All comments will be identified by a hidden field, I name them commentChallengeKeys, they have the following properties:

commentChallengeKeys in page are always MD5 encrypted
commentChallengeKeys have a common base with the oracle, a oracleKey for each comment
commentChallengeKeys are made of the a Universally Unique IDentifier, version 4 (UUID), Yes Ive get rid of the id, the sql key entropy is higher and UUID should never colllide in a reasonable amount of time when You merge data across databases

Here is the algorithm:

return md5($oracleKeys.$commentUUID) ;

Security 2
All AJAX enable functions will test the oracleKey submitted by the browser AND the commentChallengeKeys, so nobody should be able to replay the same RateUp/Down attack on multiple server.

Security 3
All parameters pass to AJAX will be sanitized on the server to avoid XSS attacks $commentTitle = mysql_real_escape_string(strip_tags($title));

Open items

Avoiding user to Rate comments too often is still not solve...
I will welcome any code review or help...

Nest steps...

Migration scripts...
Administrator panel has to be brng up to date...
Testing, testing...
Code reviews...

Do You see something more? comments are welcomed ;-)

Tags See All Tags Add New Tag...

Please Enter New Tags Separated By Comma's
Or Close

Comments

Add New

RSS

using cookies now

Cédric Walter (84.73.239.xxx) 2006-06-17 22:46:13

I've add session cookie support, and their content will be encypted with a RSA
1024 key -> I am currently fighting on installation of PHP PEAR and its crypto
library...

A new project "OpenComment" has been submitted and
accepted at joomla forge

Reply | Quote

< Prev		Next >

Another articles:

Ajax enabled OpenComment online video (2006-06-12) OpenComment, AJAX and security (2006-06-04) OpenComment will use AJAX (2006-05-28) opencomment development continue (2006-04-12) Want to join development of Joomla component (2006-04-08) logo submission by Takster (2006-03-23) OpenComment news (2006-03-19) OpenComment Logo Poll (2006-03-17) Gallery with screenshots of current status (2006-03-16) People wanting to join project opencomment (2006-03-13)

Another articles:

Ajax enabled OpenComment online video (2006-06-12)
OpenComment, AJAX and security (2006-06-04)
OpenComment will use AJAX (2006-05-28)
opencomment development continue (2006-04-12)
Want to join development of Joomla component (2006-04-08)
logo submission by Takster (2006-03-23)
OpenComment news (2006-03-19)
OpenComment Logo Poll (2006-03-17)
Gallery with screenshots of current status (2006-03-16)
People wanting to join project opencomment (2006-03-13)

Content View Hits : 2926690

Main Menu

Recommended sites

Tags See All Tags Add New Tag...

3.20 Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."