A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://mail.python.org/pipermail/python-dev/2012-February/116768.html below:

[Python-Dev] hash randomization in 3.3

[Python-Dev] hash randomization in 3.3Stephen J. Turnbull stephen at xemacs.org
Thu Feb 23 08:12:39 CET 2012
Antoine Pitrou writes:

 > How is it a "false sense of security" at all? It's the same as
 > setting a private secret for e.g. session cookies in Web applications.
 > As long as you don't leak the seed, it's (should be) secure.

That's true.  The problem is, the precondition that you won't leak the
seed is all too often false.  If a user takes advantage of the ability
to set the seed, she can leak it, or a coworker (or a virus) can steal
it from her source or keystroke logging, etc.

And it's not the same, at least not for a highly secure application.
In high-quality security, session keys are generated for each session
(and changed frequently); the user doesn't know them (of course, he
can always find out if he really wants to know, and sometimes that's
necessary -- Hello, Debian OpenSSH maintainer!), and so can't leak
them.

More information about the Python-Dev mailing list

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4