[wp-hackers] Wordpress database encryption.

[jackie sparks]

This just isn't security by obscurity. This can protect the data in the database from sql injections from rouge plugins and miscoded plugins(This seems to be a huge problem, if you read the sec lists in the past week. There have been over 10 new exploits found for different plugins). Have to know the keys to decode the data. CCC(those german guys are pretty bad has already proven that SSL certs can be cracked and replicated on the fly with a cluster of ps3 systems, http://hackaday.com/2008/12/30/25c3-hackers-completely-break-ssl-using-200-ps3s/ . 

Most crackers are opportunists. If they have the opportunity they will take it. If it's difficult they will leave it be. 

Can I randomize the usersmeta id's thru the use of a plugin so firstname is not alway 1,16,24,32 ? 

Every securty system has its fail points
> From: wordpress at dd32.id.au
> Date: Sun, 27 Nov 2011 16:05:51 +1100
> To: wp-hackers at lists.automattic.com
> Subject: Re: [wp-hackers] Wordpress database encryption.
> 
> On 27 November 2011 15:58, jackie sparks <jackie.craig.sparks at live.com> wrote:
> >> 2nd, why are you hacking core instead of using the 'query' hook? The 'query' hook should allow you to transform the data in an a manner which is exactly as it appears you would like.
> >  Thank you for that suggestion. The query hook only works when making a plugin. I "think" these changes should be in the core. It would make it harder for someone to find the code instead of just browsing thru directory in the wp-content/plugins dir.
> 
> If someone has access to the code, They have access to the keys, and
> therefore, can reproduce the query, resulting in any core vs plugin
> question being moot.
> The only advantage AES would be giving is preventing someone listening
> in on the communication between WordPress and MySQL, or those who gain
> access to MySQL (but not WordPress/PHP).
> I believe MySQL has a SSL mode to prevent on-the-wire data being sniffed.
> 
> I would *not* be focusing on making a core patch for this, it's
> something that's much better aimed at being a plugin (or a
> wp-content/db.php Dropin file if it can't be done otherways).
> Security by obscurity of where the code is is pretty stupid too if you ask me..
> 
> > 3rd, you should consider renaming your function dbuserquerychk() with a prefix, maybe like jcs_dbuserquerychk() or acs3_dbuserquerychk() or similar.
> >  Thank you. Why those function name prefixes. What purpose do they have?
> 
> Prefixing function names and/or namespacing them via classes is "best
> practices" in order to prevent clashes between plugins (can't have
> multiple plugins with the same function name, etc)
> _______________________________________________
> wp-hackers mailing list
> wp-hackers at lists.automattic.com
> http://lists.automattic.com/mailman/listinfo/wp-hackers