Comments on: Rails 2.0 CookieStore insecure after all, because… http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/ Ecchi nanowa ikenai to omoimasu Tue, 03 Jan 2012 16:14:50 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Rails 2.0 security « jos442’s blog http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/comment-page-1/#comment-7433 Rails 2.0 security « jos442’s blog Tue, 27 Nov 2007 08:35:10 +0000 http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/#comment-7433 [...] are subject to brute force attacks and session replay attacks. There’s currently a flaw that makes brute force attacks easy, although it should be fixed [...] [...] are subject to brute force attacks and session replay attacks. There’s currently a flaw that makes brute force attacks easy, although it should be fixed [...]

]]> By: Hongli http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/comment-page-1/#comment-7430 Hongli Mon, 26 Nov 2007 17:38:10 +0000 http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/#comment-7430 Just use the code from my script. :) Just use the code from my script. :)

]]> By: Ben Reubenstein http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/comment-page-1/#comment-7429 Ben Reubenstein Mon, 26 Nov 2007 17:06:33 +0000 http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/#comment-7429 I just spent a long time trying to get SecureRandom working. Is there a simple way to bring it into the 1.8 or should I just wait for 1.9 to come around? I just spent a long time trying to get SecureRandom working. Is there a simple way to bring it into the 1.8 or should I just wait for 1.9 to come around?

]]> By: Pratik http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/comment-page-1/#comment-7424 Pratik Mon, 26 Nov 2007 13:26:12 +0000 http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/#comment-7424 Ah ok. securerandom looks like a ruby 1.9 thingy. Ah ok. securerandom looks like a ruby 1.9 thingy.

]]> By: Jamie Flournoy http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/comment-page-1/#comment-7423 Jamie Flournoy Mon, 26 Nov 2007 13:20:51 +0000 http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/#comment-7423 >I’m now working on a patch Sweet! When in doubt, Ruby should always be delegating gnarly stuff like crypto to trustworthy libraries. :) >I believe that, once the secret key generator has been fixed, CookieStore will be secure by default. Sure, from a message-integrity standpoint (can't forge session data), though not a secrecy standpoint (still can read session contents). But that's how it was designed to work, so this is more of a taste/paranoia issue than an out and out bug. :) >I’m now working on a patch
Sweet! When in doubt, Ruby should always be delegating gnarly stuff like crypto to trustworthy libraries. :)

>I believe that, once the secret key generator has been fixed, CookieStore will be secure by default.
Sure, from a message-integrity standpoint (can’t forge session data), though not a secrecy standpoint (still can read session contents). But that’s how it was designed to work, so this is more of a taste/paranoia issue than an out and out bug. :)

]]> By: Pratik http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/comment-page-1/#comment-7422 Pratik Mon, 26 Nov 2007 13:19:35 +0000 http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/#comment-7422 It's been there for over a month :) It’s been there for over a month :)

]]> By: Hongli http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/comment-page-1/#comment-7421 Hongli Mon, 26 Nov 2007 13:14:51 +0000 http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/#comment-7421 Ah, I see. That's great, but the secret key generator in the application generator (app_generator.rb) is still insecure. And SecureRandom is not installed by default everywhere. It's not in the Ubuntu repositories, and I can't seem to find a download website for SecureRandom. The code should fallback to other (still-better-than-rand) methods. Ah, I see. That’s great, but the secret key generator in the application generator (app_generator.rb) is still insecure.

And SecureRandom is not installed by default everywhere. It’s not in the Ubuntu repositories, and I can’t seem to find a download website for SecureRandom. The code should fallback to other (still-better-than-rand) methods.

]]> By: Pratik http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/comment-page-1/#comment-7420 Pratik Mon, 26 Nov 2007 13:09:48 +0000 http://izumi.plan99.net/blog/index.php/2007/11/26/rails-20-cookiestore-insecure-after-all-because/#comment-7420 Umm...wait a second.. http://dev.rubyonrails.org/changeset/7966 is this not supposed to fix that ? Umm…wait a second.. http://dev.rubyonrails.org/changeset/7966 is this not supposed to fix that ?

]]>