http://www.e-junkie.com/bb/ E-Junkie Forum RSS en-us Copyright 2008, 19.5 Degrees. All rights reserved. webmaster@e-junkie.com webmaster@e-junkie.com Mon, 22 Oct 2007 21:14:15 GMT Thu, 21 Aug 2008 20:51:56 GMT 681 E-JUNKIE 5 http://www.e-junkie.com/bb/ http://www.e-junkie.com/ej/logo.gif 290 104 http://www.e-junkie.com/bb/topic/80/pg/0#post178 http://www.e-junkie.com/bb/topic/80/pg/0#post178 Mon, 22 Oct 2007 21:14:15 GMT
As for storing the password in the script, as you said you can simply just store it's md5 in the php script. Better yet, you can simply store the shared secret in the php file.

That said, we will eventually start passing HMAC hash as well but handshake will stay the same to be backward compatible.]]> E-junkie Discussions; E-JunkieExpert http://www.e-junkie.com/bb/topic/80/pg/0#post178 http://www.e-junkie.com/bb/topic/80/pg/0#post178 Mon, 22 Oct 2007 21:12:15 GMT I was just reading http://www.e-junkie.com/ej/help.selling-codes.php and I really liked the way you had the registration codes set up. That is, until I looked at it further.

Based on the example, the handshake is _always_ going to be the same. Therefore, very easy for someone to spoof.
Also, the idea of having the ejunkie login/password embedded in the php file makes me cringe (although, you could figure out the md5 of the pw and just use that). Would it be possible to make it a little more sophisticated? I was thinking along the lines of using a 'shared secret' key + hmac. The handshake would then be: hmac('shared secret', 'transaction id') If php is your thing, there is code here: http://www.php.net/sha1 This will prevent someone from just spoofing the handshake.

What are your thoughts about this? The current implementation is rather weak. Unless I'm missing something??
Thanks, I look forward to hearing back from you!]]> E-junkie Discussions; GuestUser