Re: Re: Re: PHP Crypt functions - security audit

From: Date: Thu, 19 Sep 2013 00:33:48 +0000
Subject: Re: Re: Re: PHP Crypt functions - security audit
References: 1  Groups: php.internals 
Request: Send a blank email to [email protected] to get a copy of this message 
On 16/09/13 15:58, Daniel Lowrey wrote:

More generally, PHP's stream encryption aspects are quite poorly
documented. For example, https:// streams disable peer verification by
default. While I understand that this is necessary to provide the easiest
possible user experience for things like `file_get_contents("
https://somesite.com")`, it's also horribly insecure. 99% of people using
tools like this won't know anything about this "feature" and won't realize
that their stream transfers are totally vulnerable to Man-in-the-Middle
attacks by default.
Count me as one of those that didn't know https:// streams didn't verify certificates. :)

*I consider this a bug* I understand that it's easier to code not verifying the
peer, and the hostname may not be available when you are stacking ssl over a stream.
But file_get_contents("https://...") is *precisely* the case that should work right
out of the box.

Thread (25 messages)

« previous php.internals (#69217) next »