Re: socketServer questions

On Sat, 2005-10-08 at 14:09 -0700, Paul Rubinhttp: wrote:
> rbt <rbt@xxxxxxxxxxxxxxxxx> writes:
> > Off-topic here, but you've caused me to have a thought... Can hmac be
> > used on untrusted clients? Clients that may fall into the wrong hands?
> > How would one handle message verification when one cannot trust the
> > client? What is there besides hmac? Thanks, rbt
>
> I don't understand the question. HMAC requires that both ends share a
> secret key; does that help?

That's what I don't get. If both sides have the key... how can it be
'secret'? All one would have to do is look at the code on any of the
clients and they'd then know everything, right?

> What do you mean by verification?

I'm trying to keep script kiddies from tampering with a socket server. I
want the server to only load a valid or verified string into its log
database and to discard everything else.

Strings could come to the socket server from anywhere on the Net from
any machine. This is outside my control. What is there to prevent a
knowledgeable person from finding the py code on a client computer,
understanding it and then being able to forge a string that the server
will accept?

Does that make sense?

.

Relevant Pages

  • Re: socketServer questions
    ... clients have to keep the key secure. ... > I'm trying to keep script kiddies from tampering with a socket server. ... > want the server to only load a valid or verified string into its log ... If the clients can keep a secret key secure, ...
    (comp.lang.python)
  • Re: socketServer questions
    ... >> The server just logs data, ... >> want some script kiddie discovering it and trying to 'hack' it. ... > authenticate the records with the hmac module. ... Clients that may fall into the wrong hands? ...
    (comp.lang.python)
  • Re: socketServer questions
    ... Clients that may fall into the wrong hands? ... > How would one handle message verification when one cannot trust the ... What is there besides hmac? ... mean you want to make sure that's really Bob logging into your ...
    (comp.lang.python)
  • RE: SoapHttpClientProtocol request canceled
    ... that you upgraded to 1.1 and now the existing 1.0 clients are broken? ... did you upgrade the client machines to 1.1 and not the server machines and ... this app that make it load the assemblies needed by the app with 1.0. ... inputHeaderer, String messageControlPayload, string inputMessage) ...
    (microsoft.public.dotnet.framework.webservices)
  • Re: OT: Missed the Boat on Import Logic
    ... alpha-numeric characters) and the string has a leading number (a ... participants and some were existing clients. ... and the other table will have a string of alpha-numeric characters. ... data type, converted 'xls' file, what is Access 'matching' the data type ...
    (comp.databases.ms-access)