Crypting messages

[Viped]

Hi,

How I should crypt messages when sending on my own site them from user to another? I don't want them to be plain text in a database or be readable easyly via stealing datastream over wifi.

Thanks!

[LastMitch]

@Viped

How I should crypt messages when sending on my own site them from user to another?

Read this to understand how it works:

http://php.net/manual/fr/function.mcrypt-encrypt.php

Read this if you familiar how it works and you can used this:

http://www.ibm.com/developerworks/opensource/library/os-php-encrypt/

I don't want them to be plain text in a database or be readable easyly via stealing datastream over wifi.

You are kidding me right?

If you have a password on your Database how would someone get your info easily unless someone has your wifi password and also your firewall password?

Then your question will make sense if someone did steal the info if you didn't have that set up but if you already set up what I mention above then this issue wouldn't be a issue at all.

Does that make sense?

[Viped]

Actually I meant that if I use some public wifi to send a message and someone steals that packet say via wireshark, so in that case I dont want him/her to be able to read that message, maybe not very likely to happen but just want to learn to do things securely and on my opinion rightly and by rightly I mean that in my opinion even admininstrator shouldnt be able read other people messages directly from database. Thanks for links I will check those.

[LastMitch]

Actually I meant that if I use some public wifi to send a message and someone steals that packet say via wireshark, so in that case I dont want him/her to be able to read that message, maybe not very likely to happen but just want to learn to do things securely and on my opinion rightly and by rightly I mean that in my opinion even admininstrator shouldnt be able read other people messages directly from database. Thanks for links I will check those.

I be honest with you, you really can't prevent it that happend because you are using some other company wifi. When you used some other company wifi, the company have a firewall to protect their system not yours. I mean you can protect yourself by increase the security on your browsers and also download a firewall software on your laptop. Either way, like I mention before it's really hard to prevent someone to steal your message.

[cereal]

@Viped you can use a SSL certificate to encrypt the data between the client and the server, you will need to install a CA certificate in your server, from that moment the encrypted data will be sent through HTTPS. For internal uses you can use an auto-generated certificate, when you open the https connection the browser will warn you about the trust of the website, because the certificate is not registered, to prevent this you have to register to a Certificate Authority (CA): http://en.wikipedia.org/wiki/Certificate_authority

Check this link for more info: http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html

@LastMitch wifi WEP & WPA2/TKIP keys can be cracked in minutes if the strings are weak, and once you have that it's not difficult to sniff all data passing in the wan. A part from that even a sniffer into a wired lan can catch data if the eth card is in promiscous mode. Bye :)

[LastMitch]

@cereal

@LastMitch wifi WEP & WPA2/TKIP keys can be cracked in minutes if the strings are weak, and once you have that it's not difficult to sniff all data passing in the wan. A part from that even a sniffer into a wired lan can catch data if the eth card is in promiscous mode. Bye :)

Yes, that's correct, wifi are very vulnerable. But even some cracked the wifi, that person still need to crack the firewall (whether it's Cicso, NetGear or some type of thing) then crack the server. That's why Mcdonalds and Starbuck and the Apple store has free wifi to the public because they have a 2 firewalls to protect their system and their server.