{"action":"created","issue":{"url":"https://api.github.com/repos/OWASP/phpsec/issues/108","labels_url":"https://api.github.com/repos/OWASP/phpsec/issues/108/labels{/name}","comments_url":"https://api.github.com/repos/OWASP/phpsec/issues/108/comments","events_url":"https://api.github.com/repos/OWASP/phpsec/issues/108/events","html_url":"https://github.com/OWASP/phpsec/issues/108","id":117861435,"number":108,"title":"confidentialString function uses hard-coded key","user":{"login":"asgrim","id":496145,"avatar_url":"https://avatars.githubusercontent.com/u/496145?v=3","gravatar_id":"","url":"https://api.github.com/users/asgrim","html_url":"https://github.com/asgrim","followers_url":"https://api.github.com/users/asgrim/followers","following_url":"https://api.github.com/users/asgrim/following{/other_user}","gists_url":"https://api.github.com/users/asgrim/gists{/gist_id}","starred_url":"https://api.github.com/users/asgrim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/asgrim/subscriptions","organizations_url":"https://api.github.com/users/asgrim/orgs","repos_url":"https://api.github.com/users/asgrim/repos","events_url":"https://api.github.com/users/asgrim/events{/privacy}","received_events_url":"https://api.github.com/users/asgrim/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":79,"created_at":"2015-11-19T17:15:09Z","updated_at":"2015-11-25T17:34:03Z","closed_at":null,"body":"https://github.com/OWASP/phpsec/blob/master/libs/crypto/confidentialstring.php#L37\r\n\r\nThis looks like a hard coded key that is publicly available on the internet, plain for anyone to see and easily decrypt anything encrypted by this function.\r\n\r\nPlease tell me it's not the case? :cry: "},"comment":{"url":"https://api.github.com/repos/OWASP/phpsec/issues/comments/159682738","html_url":"https://github.com/OWASP/phpsec/issues/108#issuecomment-159682738","issue_url":"https://api.github.com/repos/OWASP/phpsec/issues/108","id":159682738,"user":{"login":"abiusx","id":1401691,"avatar_url":"https://avatars.githubusercontent.com/u/1401691?v=3","gravatar_id":"","url":"https://api.github.com/users/abiusx","html_url":"https://github.com/abiusx","followers_url":"https://api.github.com/users/abiusx/followers","following_url":"https://api.github.com/users/abiusx/following{/other_user}","gists_url":"https://api.github.com/users/abiusx/gists{/gist_id}","starred_url":"https://api.github.com/users/abiusx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abiusx/subscriptions","organizations_url":"https://api.github.com/users/abiusx/orgs","repos_url":"https://api.github.com/users/abiusx/repos","events_url":"https://api.github.com/users/abiusx/events{/privacy}","received_events_url":"https://api.github.com/users/abiusx/received_events","type":"User","site_admin":false},"created_at":"2015-11-25T17:34:03Z","updated_at":"2015-11-25T17:34:03Z","body":"@kelunik > \"You type passwords in browsers and terminals everywhere, in your office but maybe also in presentations or in public transport. You usually don't do that with server credentials. You either put them into an access restricted file or one that might even be encrypted. But for that encryption you'd need a secret key as well that has to be stored somewhere. The thing you do here not encryption done right.\"\r\n\r\nBecause it is not encryption. It's \"hiding sensitive data\".\r\n\r\nYou provided a few use-cases, all of which apply to server-side applications as well. Thank you."}}