Timeline for Security of API Keygen for a cryptocurrency trading platform
Current License: CC BY-SA 3.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 8, 2018 at 16:57 | comment | added | Larry J Juncker | When I use your code I do the following: include_once('genApiKey.php'); $apiKey = Guid::NewGuid(); echo "apiKey = " . $apiKey . "<br />"; echo json_encode(array("License Key"=>$apiKey)); This is what prints out. apiKey = cf53878e-1dce-4e51-8f22-337be491044e <br />{"License Key":{}} Why does $apiKey not go into my json | |
| Jan 24, 2018 at 1:25 | history | edited | Jamal | CC BY-SA 3.0 |
edited tags
|
| Nov 14, 2014 at 9:02 | history | edited | Jamal | CC BY-SA 3.0 |
added 1 character in body; edited title
|
| Jan 24, 2014 at 12:30 | comment | added | CodesInChaos | @.r3wt I agree with @200_success that you're not ready for such a high risk project. Choose a project where a mistake doesn't mean that cryptocurrency worth thousands of USD get stolen. | |
| Jan 24, 2014 at 12:25 | comment | added | CodesInChaos |
To generate securely random bytes use mcrypt_create_iv(length, MCRYPT_DEV_URANDOM) with length set to 16 or so. Don't try to create your own CSPRNG.
|
|
| Dec 31, 2013 at 1:58 | vote | accept | r3wt | ||
| Dec 30, 2013 at 19:27 | comment | added | r3wt | there's a difference between a beginner project and "my first real project". | |
| Dec 30, 2013 at 10:16 | comment | added | 200_success | I'd recommend something less ambitious than a cryptocurrency trading platform as a beginner project, unless you're doing it privately just for fun. | |
| Dec 30, 2013 at 9:44 | answer | added | 200_success | timeline score: 17 | |
| Dec 30, 2013 at 9:32 | answer | added | Peter Kiss | timeline score: 5 | |
| Dec 30, 2013 at 8:29 | history | edited | 200_success |
edited tags
|
|
| Dec 30, 2013 at 5:04 | history | edited | r3wt | CC BY-SA 3.0 |
fixed a typo, and improved the grammar a bit.
|
| Dec 30, 2013 at 4:47 | comment | added | r3wt |
about mysql: i know. its faster to write it though and go back and change it later. about $id. yes, it comes from userCake1.4.2 standard function library. basically the system is built on top of userCake, with modified password hashing and extra functions. by default, all of userCake functions are run through stringent sanitization. Third, as i stated, i have < 6 months experience in php/mysql. i haven't figured out a way to loop back through yet without a page refresh. can you provide me an example would i just return or something, i'm not sure exactly how to accomplish it in php.
|
|
| Dec 30, 2013 at 4:38 | history | tweeted | twitter.com/#!/StackCodeReview/status/417515128486375424 | ||
| Dec 30, 2013 at 4:18 | comment | added | h.j.k. |
Three quick comments besides answering the actual question on security... First, mysql_query is deprecated and you should use newer implementations suggested here us2.php.net/mysql_query, unless you are using a much older PHP version. Second, is $id 'clean' enough to prevent SQL injection attacks in "...WHERE User_Id = '$id'"? Third, why will you want to force a page-refresh if there is a key collision, instead of just looping within the logic? In the extremely unlikely scenario of 10 key collisions, are you expecting the users to face 10 page refreshes as well?
|
|
| Dec 30, 2013 at 3:04 | history | asked | r3wt | CC BY-SA 3.0 |