Scott paragonie-scott

Let's say you have a file like this:

<?php
declare(strict_types=1);

class Foo
{
    protected $x;
    public function __construct(array $x = [])

Example code for How to Safely Store a Password in 2016.

Changelog

February 19, 2016: Initial release.

Broken?

GitHub Gist doesn't send notifications when people leave a comment, so shoot me an e-mail at [email protected]. I'll gladly fix it. Fuck advertising.

Would you (or the company you represent) consider paying money for an extension/plugin for whatever platform you currently use that fixes security faux pas?

For example:

WordPress doesn't securely store passwords.
Drupal only uses emulated prepared statements.
Magento has _____ (will fill in after it's public).
Most CMS projects don't offer secure automatic updates. (WordPress's implementation is insecure. Drupal is working on it.)

Update

Filed an issue to address this particular concern.

Thanks joepie91 for finding the folks responsible and getting the conversation started.

Currently, SVG is a security foot-cannon that allows attackers to upload a Stored XSS payload when a user views the image directly. Example.

Via Twitter

Authors consider SQLi as main attack vector. Hashed token mitigate r/o SQLi, encrypted mitigate r/w SQLi

That actually doesn't buy you anything. Consider the following table schema:

CREATE TABLE reset_tokens (
    tokenid BIGSERIAL PRIMARY KEY,
 selector TEXT,

I want to build an app that stops harassment and other forms of unsolicited bullshit.

I don't want any money for it.
I don't want to serve ads.
I just want it to perform one simple task and get out of the user's way.

Goal

A mobile app (Android and/or iOS) that only allows trusted callers to go through.

	scott@debian ~ $ php -dmbstring.func_overload=2 sammy_test.php
	bool(true)
	scott@debian ~ $ php sammy_test.php
	bool(false)

	function secure_rand(min, max) {
	var rval = 0;
	var range = max - min;
	if (range < 2) {
	return min;
	}

	var bits_needed = Math.ceil(Math.log2(range));
	if (bits_needed > 53) {
	throw new Exception("We cannot generate numbers larger than 53 bits.");

	Suppose I have a friend named Alice. Alice has registered to WhatsApp with a
	Saudi number but resides in Europe. We chat over WhatsApp regularly. We are both
	using the latest version of WhatsApp for Android (2.16.155).

	However, Alice is unable to receive or initiate WhatsApp calls, even though she
	is in Europe and is using European WiFi. If you can test this, I suggest you do.
	Get a Saudi phone number, register to WhatsApp, and then fly to France and make
	a call. You will encounter the same result even if you're on French WiFi.

	WhatsApp claims that "the Saudis are blocking the initial handshake [for