lets speak about php Encryption to protection config.php

[k3vin mitnick]

lets speak about php Encryption to protection config.php ???

[System Daemonologist]

The big problem, is the key will be store some where as available as the config.php... So it doesn't do much.

[k3vin mitnick]

coool but what do you think about the last Zend_Guard ???

[System Daemonologist]

So encryption like Zend_guard.

config.php can't be encrypted directly using zend_guard. By encrypted it by mcrypt fonctions, it can be done, if there is a key in a crypted file. But, the php bitcode, is available to third party after it's decrypt and send to the php execution engine. So, if you have access to the file, just modify the php.ini and use a bitcode decoder.

Yes, it's more secure, will create some difficulty for the majority of pirates. But any good hackers, it's not a big problem. Using a server licence, the attacker will need to run the decoder on the server, and not offline.

[System Daemonologist]

So did I answer with a good response?

[k3vin mitnick]

cooool ;-)) we need to protect all the system

[System Daemonologist]

I'm doing PHP security audit, if you ever need it.

[k3vin mitnick]

thankss man its cooool