DEFCON 18: How I Met Your Girlfriend 1/3
Why Stack Overflow recommends it
Stack Overflow users link it when answering questions about PHP session ID generation and why predictable session IDs such as md5(time()) can be hijacked.
Recommended by 3 people across 3 different months, 2011 to 2013.
What it is
Part 1 of 3 of Samy Kamkar's DEFCON 18 talk, covering newly discovered classes of web attacks. Topics include HTML5 client-side XSS, guessing PHP session cookies from weak random numbers, browser protocol confusion, NAT penetration via JavaScript and precise browser geolocation.
What people said
Recommends Shinnok · 2011-02 · Stack Overflow · on “What code is this?”
I am guessing that you ended up to that piece of code via the DEFCON 18: How I Met Your Girlfriend [this video] lecture? Great talk btw. :-) Now about the code snippet, it is C and it is part of PHP's code. This exact function handles the generation of PHP session ids. You have the entire function logic explained in the lecture i mentioned above, in case you didn't see it. As a side not, PHP does not call C functions, instead you call a PHP library function and so it happens that most of those functions are written in C and exposed through PHP. On the other hand php_session_create_id does not have an equivalent exposed to PHP, since that one is used internally by PHP when you start a session usin
Recommends Kristoffer la Cour · 2011-03 · Stack Overflow · on “securing session id”
Php's own session function is very good, the session's information isn't stored with the user but on the server, and the session id is kind of like a password. If you want to know about the security with sessions i highly recomend this video of a speaker at defcon 18. [this video] Basically the session is safe enough, but if you know enough about the server and user you could hack it, but it's a long and hard process to get through and most systems doesnt give you information enough to hack the session.
Recommends user1129665 · 2013-08 · Stack Overflow · on “Session ID of md5(time())”
You shouldn't use md5(time()) to generate a session id, this is not secure. The time is liner and can be guessable, for example some websites show when the user has loged-in, you could use this information and brute-force to hijack his session id. Second thing, you can also brute-frose on random time and there is a great chance you will get some random user session id. Also, there is a good chance that two users will have the same second thing is two users will have the same session id if they login at the same time. Have a look at this great talk ( DEFCON 18: How I Met Your Girlfriend 1/3 [this video] ), I watch it a long time a go, I can't remember the details, but I remember the speaker made s