note 39682 added to security.database

> On a completely different note, I think yet another good way to > secure passwords, etc. from being readable by someone with > access to the server is to place them in functions in compiled files > so that they are not just plain text. That might look secure, but it isn't -- imho worse than simply doing away with it. An attacker would copy the .jar or .class file to her home machine, and rig up a small Java program at leisure to issues the same calls as does your application. Alternatively, the strings themselves can extracted from those files, with a hex editor or similar. The .class and .jar file formats are well documented. Reading that documentation an attacker would know precisely where to look. ---- Manual Page -- http://www.php.net/manual/en/security.database.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+39682 Delete -- http://master.php.net/manage/user-notes.php?action=delete+39682&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+39682&report=yes Search -- http://master.php.net/manage/user-notes.php