{"action":"created","issue":{"url":"https://api.github.com/repos/OWASP/phpsec/issues/108","labels_url":"https://api.github.com/repos/OWASP/phpsec/issues/108/labels{/name}","comments_url":"https://api.github.com/repos/OWASP/phpsec/issues/108/comments","events_url":"https://api.github.com/repos/OWASP/phpsec/issues/108/events","html_url":"https://github.com/OWASP/phpsec/issues/108","id":117861435,"number":108,"title":"confidentialString function uses hard-coded key","user":{"login":"asgrim","id":496145,"avatar_url":"https://avatars.githubusercontent.com/u/496145?v=3","gravatar_id":"","url":"https://api.github.com/users/asgrim","html_url":"https://github.com/asgrim","followers_url":"https://api.github.com/users/asgrim/followers","following_url":"https://api.github.com/users/asgrim/following{/other_user}","gists_url":"https://api.github.com/users/asgrim/gists{/gist_id}","starred_url":"https://api.github.com/users/asgrim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asgrim/subscriptions","organizations_url":"https://api.github.com/users/asgrim/orgs","repos_url":"https://api.github.com/users/asgrim/repos","events_url":"https://api.github.com/users/asgrim/events{/privacy}","received_events_url":"https://api.github.com/users/asgrim/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":42,"created_at":"2015-11-19T17:15:09Z","updated_at":"2015-11-25T17:01:28Z","closed_at":"2015-11-20T08:50:24Z","body":"https://github.com/OWASP/phpsec/blob/master/libs/crypto/confidentialstring.php#L37\r\n\r\nThis looks like a hard coded key that is publicly available on the internet, plain for anyone to see and easily decrypt anything encrypted by this function.\r\n\r\nPlease tell me it's not the case? :cry: "},"comment":{"url":"https://api.github.com/repos/OWASP/phpsec/issues/comments/159672597","html_url":"https://github.com/OWASP/phpsec/issues/108#issuecomment-159672597","issue_url":"https://api.github.com/repos/OWASP/phpsec/issues/108","id":159672597,"user":{"login":"paragonie-scott","id":11591518,"avatar_url":"https://avatars.githubusercontent.com/u/11591518?v=3","gravatar_id":"","url":"https://api.github.com/users/paragonie-scott","html_url":"https://github.com/paragonie-scott","followers_url":"https://api.github.com/users/paragonie-scott/followers","following_url":"https://api.github.com/users/paragonie-scott/following{/other_user}","gists_url":"https://api.github.com/users/paragonie-scott/gists{/gist_id}","starred_url":"https://api.github.com/users/paragonie-scott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paragonie-scott/subscriptions","organizations_url":"https://api.github.com/users/paragonie-scott/orgs","repos_url":"https://api.github.com/users/paragonie-scott/repos","events_url":"https://api.github.com/users/paragonie-scott/events{/privacy}","received_events_url":"https://api.github.com/users/paragonie-scott/received_events","type":"User","site_admin":false},"created_at":"2015-11-25T17:01:28Z","updated_at":"2015-11-25T17:01:28Z","body":"> this library is not for encryption. its for hiding literal sensitive data in the application.\r\n\r\nAnd how does it do that? By using the mcrypt encryption library, of course.\r\n\r\nTrying to bury a security vulnerability with semantics is dishonorable.\r\n\r\nHere's a fun fact about open source programming that's often a hard pill to swallow: **You can't control or predict what users will do with it.**\r\n\r\nTo wit: https://github.com/search?q=qgyXyjD5YpF&type=Code&utf8=%E2%9C%93"}}