Some key gen

$param = "";
$param .= "Key-Type: DSA\n";
$param .= "Key-Length: 1024\n";
$param .= "Subkey-Type: ELG-E\n";
$param .= "Subkey-Length: 768\n";
$param .= "Name-Real: http://exmaple.com/\n";
$param .= "Name-Email: ".$_POST["from"]."\n";
$param .= "Name-Comment: ".$_SERVER["REMOTE_ADDR"]."\n";
$param .= "Expire-Date: 1\n";
$param .= "%commit\n";
file_put_contents("$tmpDir/param.txt", $param);
shell_exec("gpg --homedir $tmpDir --batch --logger-fd 1 --gen-key $tmpDir/param.txt");

PHP Session

I did a simple grep across all the session files. It appears that the data is scrambled.

For AJAX, you need to access things asynchronously and in parallel. I'm creating a temporary directory to do the access. This requires that I use my own scrambling to prevent people from snooping in on my stuff.

Beyond Passwords

USB flash storage devices will become the next second factor authentication. People like the ability to duplicate keys. It enables you to have a safety plan just in case you lose things. USB flash storage devices allow people to make safety keys in case they lose their primary one. However, because it's so easy to make a copy, it's important that they have the secret password.

Other second factor tokens, physical or data, aren't that easy to duplicate. Smart cards are designed to prevent duplication or access to their secret data. One-time password tokens are also physically made to ensure their secret data stays inside. Second factor token providers could require that services have secondary backup keys available and usable. It's still a hassle to get the secondary backup key from the manufacturer or provider, making a sharp contrast to physical keys which can be duplicated at most neighborhood hardware stores.

Upload file trick

I missed the part of the <form> tag, enctype="multipart/form-data" which allows the file to be uploaded.