how to secure Url Variables into one unreadable viarable

Question

Situation:

I need to create QR-Codes, that contains login, password and 2 other informations A and B.

These QR-Codes are non public checkcards used for online authentification.

My Boss dont want to leave the password. show the qr codes and you are logged in

Problem:

I dont want easy to copy and semi easy to read qr codes to contain a plain text like www.example.com/login/?name=abc&password=def&A=ghi&B=jkl

I would much more prefer a solution www.example.com/login2/?var=dsldpjfeepfjwefpejwfp

Question:

Is there a good way to compress different variables into one unreadable variable and then at serverside to decompress it? I tried some encryption, but they will produce binarydata that is not url friendly (and its really LONG in most cases).

Hint:

I dont need complete encryption and safety. I just dont want to show plain passwords. I am Using PHP and cannot install new php modules, but scripts are ok.

Amal · Accepted Answer · 2013-10-26 10:28:15Z

1

You could use md5(), and on logging in check if:

m5d($password . $salt) == $_GET['password'];

edited Oct 26, 2013 at 10:28

Amal

76.8k18 gold badges133 silver badges154 bronze badges

answered Oct 26, 2013 at 10:04

Peter van der Wal

12k2 gold badges24 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Peter van der Wal Over a year ago

No, im am suggesting sending an MD5-hashed over GET. Obviously having any login-information stored in an QR-code have its security-issues, but it looks like Umingo is aware of that.

Benjamin Eckstein Over a year ago

Thanks, but i need to restore the values on the serverside and sending the md5 would exploit my $salt since if hashes are public transported you could reconstruct the salt that was used.

Peter van der Wal Over a year ago

Then you have two options (that I can think of): A) Encryption, gives indeed a long string, use php.net/base64_encode to convert binary data or; B) If you need short urls: store a key with associated data in a database and use that key in your URL, as every URL-shortener (like tinyurl.com) does

Peter van der Wal Over a year ago

'would exploit my $salt' : if you use a per-user pepper besides your salt (as is always a good idea) you won't have this problem

Terence Eden · Accepted Answer · 2013-11-01 09:57:39Z

0

If you don't want to encrypt it, you have two choices.

Base64 - will create something like dXNlcm5hbWV8cGFzc3dvcmR8dmFsdWV8c29tZXRoaW5n

UUencode - will create something like A=7-E<FYA;65\<&%S<W=O<F1\=F%L=65\<V]M971H:6YG

Both a trivially easy to reconstruct for the end user if she is determined.

If you want to make something like Base64 slightly more challenging to "decrypt" you could either run a basic substitution cipher on it first (a=b, b=c, etc) or apply a known shuffle to the string (swap character 1 with 2, swap 3 with 5, etc).

It's not perfect, but it will provide a small measure of defence against anyone who wants to reverse engineer what's in the code.

answered Nov 1, 2013 at 9:57

Terence Eden

14.4k3 gold badges53 silver badges102 bronze badges

Collectives™ on Stack Overflow

how to secure Url Variables into one unreadable viarable

2 Answers 2

4 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related