phpwn: PHP cookie PRNG flawed (Netscape redux)

2010-08-05 Thread travis+ml-cryptography
https://media.blackhat.com/bh-us-10/whitepapers/Kamkar/BlackHat-USA-2010-Kamkar-How-I-Met-Your-Girlfriend-wp.pdf Hey, another PRNG is broken. Raise your hand if you're surprised. -- A Weapon of Mass Construction My emails do not have attachments; it's a digital signature that your mail program

Re: phpwn: PHP cookie PRNG flawed (Netscape redux)

2010-08-05 Thread Chris Palmer
travis+ml-cryptogra...@subspacefield.org writes: https://media.blackhat.com/bh-us-10/whitepapers/Kamkar/BlackHat-USA-2010-Kamkar-How-I-Met-Your-Girlfriend-wp.pdf He doesn't mention the php.ini variables session.entropy_length and session.entropy_file. Last I checked, their default settings were