If you want a "secure pickle" you should corrupt it on creation so that it needs... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

sitkack on June 6, 2016 | parent | context | favorite | on: Exploiting Misuse of Python's “Pickle”

If you want a "secure pickle" you should corrupt it on creation so that it needs a to uncorrupted to be read. preferably with the HMAC.

ashitlerferad on June 6, 2016 [–]

No, just switch from pickle to json.

sitkack on June 6, 2016 | [–]

But how would you get arbitrary code execution? Pickle does solve a lot of problems, but it creates so many that I think it should be removed from the battery pack. You can't make HMAC integrity checks optional, and you make the mandatory by breaking the payload.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact