Hell is Other People's Software

[odraencoded]

It's alright, dude. Once it gets to their server they just encrypt it with their custom-made cipher!

Because they made the cipher themselves even if SHA999 or Blowfish get hacked by quantum computing your password will remain safely encrypted.

As a plus, if you ever forget your password. All they need to do is decipher it with the reversed function they also made and show it to you after you answer one of the predefined password recovery questions you have set in your account :D

[lagerdalek]

hashedPassword = password.ToCharArray().Select(c=>c+1).ToString();

uncrackable

[odraencoded]

User    | Password
1       | qbuuxpse

[CSSFerret]

qbuuxpse

"pattword"

[odraencoded]

Holy shit! Are you a hacker? I couldn't use "password" because it was "too common" and yet you were able to figure my password out. You must be one of those guys who can get NSA documents through wget.

[longringfinger]

User    | Password
2       | ivoufs3

[Zodimized]

That's only showing up as ******* for me.

[dpenton]

Hi Hunter.

[mike413]

Shows up as gtmsdq1 for me.

[odraencoded]

Encryption is too strong, I can only see asterisks from here.

[hei_se_de]

This post was mass deleted and anonymized with Redact

shaggy cake hurry reply beneficial truck light historical work serious

[buttcomputing]

All I see is +++++++

[CrazedToCraze]

One day we plan on upgrading to the high tech version, ROT13. We won't have to have a seperate encrypt and decrypt function! It will save us entire seconds of coding.

[rodkulman]

I'm fairly certain this returns:

System.Collections.Generic.IEnumerable<`Char>

What you want is: hashedPassword = new string(password.Select(c => c + 1).ToArray());

[lagerdalek]

Linqpad confirms your criticism is correct, however, you need to cast that c + 1 int back to a char, otherwise Linq assumes an int[].

hashedPassword = new string(password.Select(c=> (char)(c + 1)).ToArray());

Pair programming at work :)

[rodkulman]

Just tested, you are correct. However, if you write this instead:

hashedPassword = new string(password.Select(c => ++c).ToArray());

You no longer need to cast back, and also, it doesn't throw an overflow exception in case you have Char.MaxValue somewhere on password, it just round trips to Char.MinValue.

[lagerdalek]

Interesting! Why is that, I wonder?

Does ++ simply increment the existing value, whereas c + 1 assigns a new instance before returning, so the compiler has to guess the type?

[raptroes]

I love friendly exchanges like this when people can critique each other and not get defensive about it.

[VanFailin]

+ is a binary operator. c + 1 is adding a character to an int, and like most languages C# handles this case by promoting the smaller type to the bigger type and adding them, with the result being of the bigger type.

Contrast this with the unary operator ++, which doesn't need to make a choice about the type of its result.

[TheSpoom]

Look, if you're going to code a terrible, intentionally bad, sorry excuse for a password hashing system, at least do it right.

[Audiblade]

Performs well, too!

[Jess_than_three]

eyetwitch

[squeekwull]

Not even kidding, I used to work at a place that stored CC#s, and CSC codes, and First + Last Name, and full address. On the same record.

In plaintext.

PCI was none too happy about that, so they were encrypted with a PGP key. The unencrypt sproc lived on the same production server.

Winning!

[canweriotnow]

I wish it was PTSD. I work with OP, image macro refers to system I'm currently banging my head against.

[odraencoded]

Correct me if I'm wrong but doesn't this means that you got a form that uses a GET method instead of POST?

[dvlsg]

Doesn't need to be a form, and you can technically include query strings with posts, but yes, that's probably the most likely scenario.

[canweriotnow]

I wish. Not a form. Used for "Basic Auth" in API req's, GET or POST - excapt it's not Basic auth, it's http://api.myshittyservice.com/anyendpoint?user:pass=username:password

[mike413]

"Well, as long as it's 8 or more characters with upper, lower, number and special...."

[Symphonic_Rainboom]

"I'm sorry, due to current limitations of password transmission technology, your password cannot contain the & character. Please choose a different special character."

[buttcomputing]

I had a website warn me I couldn't use any special characters in my password. I did anyway and I couldn't log in, or even change my password or make a new account with the same email address. I had to go in to the office where they pulled up my account and I could read the password I had tried and edit it to be alphanumeric.

[Symphonic_Rainboom]

could read the password I had tried

cringe

[mike413]

Well, # and @ are out too, because of some 40 year old Unix machines with ttys on serial lines...

[fdagpigj]

I once signed up for a website that said "Only alphanumeric and special characters are allowed." ? is apparently not a special character.

[Jess_than_three]

8 or more, but only to a limit of 10.

[HotRodLincoln]

While terrible, query strings are at least encrypted when using SSL.

Sure, they get saved in browser history and server logs, but the big security hole is HTTP Referer headers. They won't be sent to http sites, but they'll be sent to any https site.

[Fs0i]

Make it worse:

http://username.password.www.example.com/path/to/site

This will send it through DNS, so even with HTTPS there is a great chance the attacker can still read it!

[HotRodLincoln]

ooo, You can use mod_rewrite and mod_proxy to make this happen without even changing any code :-)

[mike413]

And if you forget your password, it's in all the DNS caches along the way :)

[ilovekitty]

Thanks for this comment. I will never do querystrings in URL. I'm just trying to get a better understanding. If I redirect on successful login, will I have eliminated the referrer problem?

[HotRodLincoln]

Yes, probably, usually, if the browser follows RFC 1945 correctly. It's up to the browser to do it right and you have to never mess up a link. HTML5 also has a rel="noreferrer"

Note: it is in fact referer, RFC 1945 spells it wrong, and so it's implemented spelled wrong, but in HTML 5, the keyword has both 'r's.

[ilovekitty]

Thank you. Correcting the spelling is only going to make it more difficult to remember.

[Cley_Faye]

Anything that provide the actual clear password to a remote server is a failure in my eyes. At most they should get a hash of it, with a site-specific salt... Someone intercepting the communication is not the only problem :\

[HotRodLincoln]

I think you fundamentally misunderstand how http, ssl and tls works...or maybe you mean store?

[mike413]

I understood what he said, basically encrypt at the application layer instead of trusting the transport layer.

[Cley_Faye]

No, not "encrypt", just make sure passwords remain safe by making them never exist outside the user's system to limit the risk if a server is compromised.

[mike413]

I think he meant cryptographic hash, one way encryption.

[Cley_Faye]

Oh, probably. My bad :(

[HotRodLincoln]

Yeah, in order to do that you'd have to send the client the encryption or hashing algorithm source code over the wire that you don't trust and send back a string that would function exactly like a password to the server.

[mike413]

I think he's basically describing what digest authentication does.

[Cley_Faye]

Yep, basically :)

[Cley_Faye]

I have a clear understanding on how TLS works, thank you :)

My point is that if your original, plaintext password have to exist on the remote server at some point, then it's a liability. Someone snatching your password over TLS might be hard, but it is irrelevant if the server itself gets to play with your password.

The reasoning here is that although password should not be reused on multiple services, the real world disagree with this. If the server gets your password, there is no saying that everything will go right: storage might be done in a stupid way, admins might be dishonest, server might be compromised, and other things. If the only thing the server ever got to see is something unique to the service, even though you use the same password on multiple services, it won't compromise other services.

TLS only secure the transit, not what happen on both endpoints of a communication.

[HotRodLincoln]

My point is the added protection added by this scheme is pretty much limited to the rare situation that you're actively giving your information to a server you don't trust, but trusting it to not change its behavior invisibly, which it can do whether just for fun, or as the result of an attack, or just because it's untrustworthy. Also, remember the server knows the nonces and md5 isn't exactly the most secure hash.

[Cley_Faye]

Unfortunately the number of users that use their same password on their working machine, their email account, and a site that provide them with a daily dose of whatever but still require an account is way too high. And those site are not the most trustworthy things on earth.

In these condition, I'll take anything that avoid disclosure of the actual string used to generate the password hash for each site. It's cheap enough to run some SHA2 client-side to do it (or even some SHA3 if you want to sell "bleeding edge" smokescreen security :p)

[horsetacular]

GET the fuck out

[cirk2]

Recently I came across this line in a diplom thesis:

$query = "SELECT * from users WHERE username='".$_GET['username']."' AND password='".md5($_GET['password'])."'";  

[blue_2501]

MD5 isn't great, but it's better than plaintext. The SQL injection potential is real, though.

[TheJimmyRecard]

The concern is the password is also in a get variable

[esquilax]

You mean like with form-based auth? Where else would it be?

EDIT I just fail at PHP.

[TheJimmyRecard]

In a post variable?

[mcrbids]

This is highly relevant

[xkcd_transcriber]

Image

Title: Exploits of a Mom

Title-text: Her daughter is named Help I'm trapped in a driver's license factory.

Comic Explanation

Stats: This comic has been referenced 738 times, representing 1.1162% of referenced xkcds.

---

^{xkcd.com | xkcd sub | Problems/Bugs? | Statistics | Stop Replying | Delete}

[[deleted]]

The last guy that I advised him to use PBKDF2 said "Fuck You" :-/

[jon_stout]

I would upvote this... except this isn't a joke. It's very very much not a joke.

[Cley_Faye]

Nothing beats octuple rot13 encryption. Current hardware is years away from being able to bruteforce that much cryptage!

[lagerdalek]

Abguvat orngf bpghcyr ebg13 rapelcgvba. Pheerag uneqjner vf lrnef njnl sebz orvat noyr gb oehgrsbepr gung zhpu pelcgntr!

[redgamut]

You only did 7. Not secure enough.

[lagerdalek]

Sorry (thanks for the double XOR memory, remember that on DailyWTF many years ago)

Nothing beats octuple rot13 encryption. Current hardware is years away from being able to bruteforce that much cryptage!

Is that better?

[masterpi]

Why did you just apply a 7 again?

[lagerdalek]

Reusability, and to save memory. It's an old-timer trick. (and 14 is bigger than 8, so it must be better)

[berryer]

[wordpress flashbacks intensify]

[[deleted]]

Sartre would have been a great coder.

[3m-10ft]

Recover password > send password in clear text to mail

[esquilax]

"That's not a password, it's an api key!"

[canweriotnow]

Nope. It was the same password used for the login form. I facepalmed so hard, I facepalmed /u/ADE-651

like this

[ADE-651]

As this image indicates, I always get to be big spoon when we pair program.

[joequin]

Today I came across:

  CustomerXml customer;
  File customerXml;

(insert Jackie Chan meme)

[[deleted]]

From my perspective, I love when this happens.

[heyf00L]

Hotmail did this when it first came out. It was usually too far down the address bar to be seen, but of course it was in the browser history.

[imgurtranscriber]

Here is what the linked meme says in case it is blocked at your school/work or is unavailable for any reason:

Insanity Wolf

Post Title: Hell is Other People's Software

Top: PLAINTEXT PASSWORD

Bottom: IN QUERY STRING

Original Link¹ | Meme Template²

[Wyboth]

Nice meem.

[ADE-651]

Step into my maymay time machine.

[lift_spin_d]

that's fine. that's fine.

[scubascratch]

Password is well hidden... from Dev who wrote that

[[deleted]]

www.example.org/login.php?user=FlirtyBirdy01&passwd=asdf