Sorry to bring this topic up again, but I’ve experienced the same problem with OpenID 3.0
Googling the matter brought the following solution:
– in wp-content/plugins/php-openid/Auth/OpenID/CryptUtil.php I’ve replaced
if (!defined('Auth_OpenID_RAND_SOURCE')) {
/**
* The filename for a source of random bytes. Define this yourself
* if you have a different source of randomness.
*/
define('Auth_OpenID_RAND_SOURCE', '/dev/urandom');
}
with
if (!defined('Auth_OpenID_RAND_SOURCE')) {
/**
* The filename for a source of random bytes. Define this yourself
* if you have a different source of randomness.
*/
define('Auth_OpenID_RAND_SOURCE', null);
}
After doing that everything was working just fine.
But then, it was noted by that person that this way of dealing with this kind of problems was not secure ’cause it made the script use “a pseudo-random sequence that is relatively easily cracked” (I’m quoting here ’cause I know very little about these things). It also was noted that these kind of problems could arise in cases when PHP couldn’t have access to a good source of randomness (whatever that may be, I’m quoting the helping person again).
The question I now have is whether I’m actually endangering my blog credentials (login/password) each time I comment somewhere using my blog URL as an OpenID? Somehow it seems unlikely since the credentials are get sent to my own server after all and are not shared with this other site where I comment, is it right? Or am I possibly handing other persons the way to identify as me by using this insecure pseudo-randomness? Generally, how dangerous it (no real randomness) is?
And the second question is (sorry for being this talkative today) why my PHP might have no access to real source of randomness? Should I talk to my host provider about it, should they provide me with /dev/urandom (guess that is the path to some server program)? Is it a possible thing with virtual hosting or is it only available with VPS/DDS?
