Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69219
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.43 as permitted sender)
MIME-Version: 1.0
Sender: tjerk.meesters@gmail.com
In-Reply-To: <523A466C.4070903@gmail.com>
References: <CAH8MpnnTGD0xAwG1j9sh10EC6XzdscVRLbJzEMG6qWSBK5c17w@mail.gmail.com>
	<523A466C.4070903@gmail.com>
Date: Thu, 19 Sep 2013 09:06:56 +0800
Message-ID: <CAHMUw2HxcWgOBxiK=r4y6FgWF_Gkhgc6BgHxF_bgLLJG9RVxmQ@mail.gmail.com>
To: =?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?= <keisial@gmail.com>
Cc: Daniel Lowrey <rdlowrey@gmail.com>, johannes@schlueters.dot.de, addw@phcomp.dot.co.uk, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b33d3748df18504e6b22b6e
Subject: Re: [PHP-DEV] Re: Re: PHP Crypt functions - security audit
From: datibbaw@php.net (Tjerk Anne Meesters)

--047d7b33d3748df18504e6b22b6e
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 19, 2013 at 8:33 AM, =C1ngel Gonz=E1lez <keisial@gmail.com> wro=
te:

> On 16/09/13 15:58, Daniel Lowrey wrote:
>
>> More generally, PHP's stream encryption aspects are quite poorly
>> documented. For example, https:// streams disable peer verification by
>> default. While I understand that this is necessary to provide the easies=
t
>> possible user experience for things like `file_get_contents("
>> https://somesite.com")`, it's also horribly insecure. 99% of people usin=
g
>> tools like this won't know anything about this "feature" and won't reali=
ze
>> that their stream transfers are totally vulnerable to Man-in-the-Middle
>> attacks by default.
>>
> Count me as one of those that didn't know https:// streams didn't verify
> certificates. :)
> *I consider this a bug* I understand that it's easier to code not
> verifying the
> peer, and the hostname may not be available when you are stacking ssl ove=
r
> a stream.
> But file_get_contents("https://...**") is *precisely* the case that
> should work right
> out of the box.


To be practical, verifying certificates requires an up-to-date CA bundle to
be shipped with PHP; perhaps this is a simple thing to do, I'm not sure.
This is an oft seen scenario for cURL; the developer would see the
certificate issue, search online and continue with `CURLOPT_VERIFY_PEER =3D=
>
0`. That said, at least cURL is configured to check the certificate by
default.



>
>
>
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


--=20
--
Tjerk

--047d7b33d3748df18504e6b22b6e--