On Fri, May 19, 2006 3:00 pm, Lawrence Kennon wrote: > But just out of curiousity, let's assume you are > running a shopping cart which takes credit cards and > passes them on to whomever approves them and you don't > _ever_ write this info to files. Aren't you also > vulnerable to someone being able to "snoop memory" on > your process for sensitive information? > > I mean at some point some program on the server has to > take the customer's credit card, and that info is in > memory somewhere until you get the approval. Isn't > that true? Yes, and it's worse than that. See, if your server gets busy, then those chunks of RAM *will* get paged out to hard drive. And, in theory, users can read that hard drive data not only during the transaction, but long after, until RAM has a page-fault again and wipes it out. So now you've got *TWO* potential "holes" in your armor. Throw your gpg into the mix, and you've got even more, including: #1. gpg insecure RAM, unless your host change bit for you #2. The data you pass from PHP to gpg through exec is visible to a 'ps' command, if it's timed right, or run often enough, fast enough, to catch it. A quick hack shell script will pretty much catch ALL your CC#s as long as it runs #3. gpg itself may get page-faulted to disk (this may be a duplicate of #1 -- I'm NOT an expert) Bottom line is, as a beginner in this realm, you REALLY should not be trying to do what you are trying to do. You NEED to go to your client and explain the following facts: *IF* their data is every compromised, they are required BY LAW to contact EVERY customer and tell them: "Sorry, we just gave away your credit card number to some crooks. Have a nice day." Then describe all the ways (above) that the data is at risk. PLUS, let's look at the store-front end of things. Is the PC locked in a secure location? Or is it just in some office somewhere? How hard would it be for a Bad Guy to get ahold of the PC long enough to hack it to catch keystrokes and snag the private key? Is it behind a firewall? With up-to-date virus-protection? And it's not used for normal web-surfing, right? Cuz, right there, you're just BEGGING some Bad Guy to install mal-ware that will snoop on your private key. Are there any employees who have access to this PC? What sort of background checks have you run on every employee? Do you REALLY want to run the risk of having to DESTROY your reputation with all your customers? -- Like Music? http://l-i-e.com/artists.htm -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
