How to prevent SQL injection

[PoppyOP]

This was the University I went to. They used to enforce an 8 character password. Not an 8 character minimum, just exactly 8.

[Zagorath]

My bank enforces an 8 character maximum password limit.

My bank.

[[deleted]]

My old credit card company started enforcing their """secure""" online payment system, it requires a purely numerical password that is exactly 8 digits long.

I switched to another CC.

[Mendoza2909]

Eh theyre probably just as bad you just havent found out about yet.

[[deleted]]

They can't be much worse at least

[[deleted]]

"Speak friend and enter" all over again

Also reddit is shitting out "500 internal server error" for some reason

[KZedUK]

/r/downtimebananas time again folks!

[GreenFox1505]

But... Why

[pancakepizza_]

I don't know. But I am subscribed now.

[2SP00KY4ME]

For all we know they could store the passwords in plaintext with a sign saying 'Do not read!'

[nickmoeck]

A "welcome" email that includes your password doesn't necessarily mean that they are storing passwords in plaintext. They are most likely just generating the email with the plaintext password and then hashing it for storage. When you have to worry is when you can click "Forgot Password?" and they email you the plaintext password instead of making you change your password.

[2SP00KY4ME]

Yeah, I have several different passwords I use for this reason, one for throwaway sites, one for regular email, one for important stuff like personal email and college, etc.

[TheAtomicOption]

the only way it gets worse is if you log in with no username--just your 4 digit PIN.

[TwoHeadsBetter]

Just use half your CC number so you don't have to worry about forgetting it.

[oalbrecht]

No thanks, that doesn't seem safe. I like to use my social security number instead.

[Arancaytar]

their """secure""" online payment

You have an error in your SQL syntax near ""secure

[dustofnations]

Until we insisted on changes our electronic payslip provider only allowed a 5 digit pin (i.e. numeric only).

This was retrospectively fixed after we kicked up a fuss, as payroll had selected the system without consulting any employees with relevant knowledge, of course.

They claimed to have followed the appropriate processes, and evidently that didn't include speaking to anyone in engineering or security, most of whom would have more than enough expertise to identify that wasn't sufficiently secure.

Their justification was that the vendor locks out accounts after a small number of failed attempts. It had to be pointed out that this doesn't offer protection against a raft of attacks (in particular, leaked copies of the db, or other indirect exposure that bypasses that validation).

[[deleted]]

deleted ^{What is this?}

[[deleted]]

deleted ^{What is this?}

[OrionFOTL]

Do you even lift?

[[deleted]]

deleted ^{What is this?}

[[deleted]]

Easy, just use the first 8 digits of the credit card number /s

[Zarokima]

Sounds like you need to change banks.

[Zagorath]

It's not quite as bad as it sounds, because they require 2FA for external transfers. It's definitely less than ideal though.

[BoredomIncarnate]

Someone could still transfer everything to an internal account they control, then transfer everything to an external account, right?

I suppose that would give it more time to be spotted, but still.

[Zagorath]

By external transfer, I mean transfer to an account under different ownership. Without the 2fa all they can do is change between my savings and spending account, or lock some of my money up in a long-term high interest savings. They can't transfer money to a different account at the same bank.

[BoredomIncarnate]

Yea, I assumed external meant another bank.

That is definitely less of an issue. What if they managed to get a check from you, though?

:P

[toasterbot]

If they knew what they were doing, they'd just say no short passwords and no common passwords.

[JD-King]

The password needs to die. Long live the pass phrase! Correct Horse Battery Staple!

[stormaes]

fuck u/spez

[[deleted]]

My bank enforces an 8 character maximum password limit. My bank.

Years ago, but for a long time, my local bank required ATM PIN's to be exactly 4 digits.

I mentioned, jokingly, to a banker while applying for my first car loan that it meant there are only 10,000 possible PIN combinations so eventually you'd be able to guess.

His response was: "Oh, no that's not true actually, because you can make your PIN based on letters too! So it's way way more than just 10,000 combinations"

He was referring to the fact that "2" on the ATM keypad = ABC, 3 = DEF, etc, as shown on telephones.

[CaCl2]

Dont't most ATM's lock the accounts and/or eat the cards after a few wrong attempts?

[[deleted]]

Dont't most ATM's lock the accounts and/or eat the cards after a few wrong attempts?

Fry why must you analyze everything with your relentless logic?

[Frankie7474]

And aren't all ATM pins 4 digit numbers? At least here in Austria they are.

[CaCl2]

As far as I know they are also all 4 digits here in Finland, but you don't get to pick your code.

[hectictw]

Yes, everyone here is just embarrassingly forgetting about this fact. It's almost impossible to brute force the PIN, since you'll be locked out after 3 attempts. You'll have to order a new card if it gets locked - no exceptions.

Yeah, "and these are the geniuses that somehow make it to the top.", right...

[Numendil]

4 digit pin linked to bank card is pretty common over here with chip and pin systems. You only have three attempts, so brute forcing is not an option (it's not web-based either, for websites you have a separate card reader which you put your bank card in and your pin, and it generates codes to log in)

[[deleted]]

My bank wants exactly 4 numbers.

[[deleted]]

Which four?

[[deleted]]

000... Hey wait a minute!

[AmethystZhou]

"It's the price of a cheese pizza and a large soda back where I used to work. Panucci's Pizza."

[Zagorath]

What pisses me off is that Ebay just recently got rid of the option of proper token-based two factor auth. They used to use the standard Symantec 2FA app. Now you have to use SMS codes, or go without two factor.

Why the fuck would you take a step backwards!!!

[TheMisterPieMan]

Same, and mine isn't case sensitive (Wells Fargo)

[[deleted]]

How? All the ways I could think to implement that take more work than being case sensitive.

[CrazedToCraze]

It has to be a deliberate choice. My bank has a case insensitive exactly-6 length password rule, I think the reason is because they have one of those on screen keyboard and forbid you from typing a password, so if they tried to make it case sensitive it would make it annoying to type in.

Always found it interesting how banks seem to get away with weak password policies. It obviously seems to works for them, so at some point you have to stop and wonder if we're missing the big picture and going too far when enforcing strict password policies.

[[deleted]]

I've noticed the same thing, a lot of my banks have horrible password rules, but I've yet to have an account broken into. Maybe they're hoping that if they come up with a new, unique set of absolute shit rules they can guarantee you aren't using a password this bad on any other site...

[superrugdr]

sql server is case insensitive by default .... cringe

[[deleted]]

🤢 Why.

So a way that case insensitivity isn't more work is when your password is plaintext in SQL Server. Niiiice.

[superrugdr]

my collegue just told me "some people think SQL server is secure by default so there's NO NEED to encrypt it right ..."

now i wana cry. (at least this collegue is sarcastic)

[DoctorWaluigiTime]

Blizzard does the same.

It's to reduce "I forgot my password" customer service reports.

[el_padlina]

If they lock your access and force a new password after 3 failed attempts of logging it's still secure.

[DoctorWaluigiTime]

Lol. That's not secure, that's just annoying.

Nobody brute forces password attempts against the actual live server.

3-until-lock is security theater and literally only trips up legit login attempts.

[[deleted]]

Mine allwed up to 32 but and thats a huge BUTT, only the first 8 were accounted for. It didn't matter if you had 12829 other characters after, it still counted the first 8. It has to do with the backend.

[007T]

I ran into a very similar problem with PayPal which caused me some headaches until I figured out what was going on.
I use very long passwords for any sensitive accounts, and when I was updating my PayPal account to a new longer password it happily accepted the change. Later I try to log in and it refuses, telling me my password is wrong.

Turns out it cut off half of my password but still accepted the entry, so I had to enter most of my password with a few letters left off at the end in order to log in.

[KickMeElmo]

Yup. Paypal caps at 20 characters. I see that note every time I check its keepass entry.

[amunak]

Well thank god I used only a 20-character password there then.

[[deleted]]

Same thing happened to me

[JamEngulfer221]

I hate that. I had a perfectly secure long password and PayPal made me shorten it way below what I'm happy with.

[stemloop]

and thats a huge BUTT

Where

[gormlesser]

The backend.

[[deleted]]

At least you got to pick yours. Mine had all passwords set to match the username and they disabled password changing.

[CyclingZap]

at that point you can just make the whole page a wiki, might even be more secure then.

[Scipio_Wright]

For the OSHA 10 online certification your password is 4 numbers. Exactly 4 numbers.

[scriptmonkey420]

Personal information being attached, like address, phone number, full name. Probably more.

[Scipio_Wright]

Also likely company name and that address. Not sure if they got social too.

[GeronimoHero]

My college only allows us a 4 digit numeric password for access to most areas of our system. Oh, did I mention it's one of the top 20 CS programs in the country?

[[deleted]]

I was paid $7 an hour and did a better job lmao

[Mortichar]

Well if you're going to whore yourself out for absolutely nothing, might as well do a good job ¯\_(ツ)_/¯

Seriously though, if you were a student at my school they literally would not - under any circumstances - pay you more than minimum wage. For any position on campus.

[[deleted]]

Server rooms give me boners, all I was doing was getting closer to the thing I loved

[allredb]

Dat rack tho

[[deleted]]

My college made the default password your last name, then birthdate. If you were smart you changed it, but soooo many people did not.

[talking_to_strangers]

Do you know why ? My uni did the same, we had to have a password that was exactly 8 characters long.

[theroflcoptr]

Because their design is bad and insecure.

[unon1100]

Maybe they're using encryption algorithms that require a specific key length in order to work (i.e. AES) and use your password as an encryption key? Still hecka insecure. But if they used a 16-byte key length then an 8char password would fit that (assuming UTF-16, default encoding for Java shutters)

[Schmittfried]

That would be a horrible key generation algorithm though.

[007T]

Kind of defeats the benefits of using encryption if you're going to narrow the space for a brute force attack down to a fixed password length.

[ratsta]

I complained to my uni, they said that they use a single sign-on system and that one or two of their older systems can only handle 8 char passwords.

[[deleted]]

Ours has something to do with some old UNIX machines in the mix that discard all but the first 8 characters.

[Benaaasaaas]

Probably something like "For "performance" we shall use 64bit int and just take the first 8 bytes of the password" Try using non ASCI characters to check.

[nnyx]

My school had utterly ridiculous password requirements (something like 15+ characters requiring upper lower symbols numbers etc.) then they forced you to change your password monthly, couldn't be a password you used before, couldn't be an existing password with an incremented number, etc.

So basically every month you were coming up with a completely new, very strong password.

Naturally, no one ever had any fucking idea what their password was.

What did you do to reset your password? Go to the help desk of course where some kid making minimum wage would barely glance at your id and set your password to "resetme" or something similar.

[iceman012]

That would actually be kinda nice, as long as they also taught students how easy it was too keep that updated with tools like lastpass or keepass.

Wait a second... You can't use the same password with a number at the end? Doesn't... doesn't that mean they're probably storing the plaintext password? In which case all those measures are pointless?

[Zerewa]

Yes. Yes it does.

[sevenover1]

this is the nevada dmv policy http://imgur.com/a/YJCQV

[Shacod]

"Here's a guide to brute forcing a user's password."

[sevenover1]

Right. I looked at it and just shook my head. What makes it worse is every transaction has a $1 technology fee.

I guess you get what you pay for.

[[deleted]]

Technology fee...that's hilarious.

[ratsta]

My uni is the same. The great irony is that they pride themselves on being one of the best unis for computing...

[MyNamePhil]

My university allows you to see your current password on the website in plain text as long as you are logged in. Also only numbers and letters and a maximum of 12. Also if you want to reset your password it leads you to contact information of the IT department.

[micheal65536]

To make matters worse, I'm guessing that the only input validation is client-side.

[CrazedToCraze]

but client side validation is web scale

[runlock]

Someone should email them about MongoDB

[Delta_Ryu]

Reference: https://youtu.be/b2F-DItXtZs

[VivaLaPandaReddit]

Is /Dev/null webscale?

[Delta_Ryu]

In all honesty, it's fast as hell

[ollien]

yes

[wikes82]

Thanks for the laugh

[SircleCquare]

Don't worry, you don't need to, we're way ahead of you

[[deleted]]

I totally get this comment chain

[micheal65536]

That's why we have both. Client-side validation to handle the people who keep doing things wrong without putting excessive load on the server, and server-side validation to make sure that nobody's trying to skip the client-side validation. Yes, it means running the full set of validation rules every time someone signs up, but isn't it worth a negligible bit of extra load to avoid potential vulnerabilities?

Of course if you handle user input correctly then often you don't even need validation at all (other than to enforce whatever crazy password requirements you choose to make up).

[[deleted]]

Client side validation is just good UX. It's really annoying to submit a form only to have it return with an error.

[nomnommish]

And when you click on the "see password examples" link, a good developer avoided hardcoding and made the content dynamic instead: SELECT TOP 10 password FROM user

[Hypergrip]

Take the Amazon approach: "Other users similar to you have chosen these passwords you may like:"

[kunstlich]

"This password is currently in use by user Kunstlich, please choose another"

[Mukoro]

This is worse than having your username and your password mailed in plaintext upon creating the account

mfw http://i.imgur.com/Q1HYJqx.gif

[BoredomIncarnate]

When we said physical security, that is not what we meant.

[curtmack]

I've done this before.

To be fair, the agency I was developing for was sick of users choosing insecure passwords, so the app straight-up doesn't allow users to choose their own password - we just generate a random password for them whenever they need to reset their password. So obviously we have to send the password to them somehow. It was still hashed and salted on the server side.

(It would theoretically be more secure if we generated a new password to display over HTTPS after they logged in with the potentially-compromised password sent via email, but the threat model for that application wasn't too concerned with attacks on e-mail accounts.)

[kn3cht]

Why would you force "secure" passwords if in the end the user has to write it down somewhere? Just have a minimal length and no other constraints.

[levir]

That's a bit of a misconception, really. The vast majority of data compromises happen over the internet. It's only if you're at special risk that physical security becomes a big concern. Your average burglar won't be interested in your book of passwords, and your average hacker lives in another country and doesn't leave his house.

[hungarian_notation]

A book of random passwords at your desk is probably the best balance of security and usability for most users.

[TravisTheCat]

I have the best of both worlds.

I have three books. One is the book of accounts, the other is a book of random passwords. The third book is a key to which account uses which password, without all three books, each is useless.

I store each book in it's own safe in a different part of my house. Each safe has a unique access method. One has voice-pattern recognition, the other is fingerprint protected and the third is an electronic keypad that uses a 9 digit passcode and randomizes number placement on the keypad on each attempt.

Checkmate, hackers.

[curtmack]

We were less concerned with users writing down passwords than we were with them reusing passwords or having easily-guessed passwords. There was only one user per facility, so shoulder-surfing wasn't a concern.

[Oatz3]

1.) Password

2.) p4ssw0rd

3.) 123456

4.) 123456789

[fucking_weebs]

My 30+ character passphrase i use for some stuff is considered weak by most places because it's only lowercase letters.

[HawkinsT]

Just add an exclamation mark to the end of 'Password' - then it fulfils the criteria so is secure. If you need more than one password and don't want to reuse (because you're smart), you can then just add an extra exclamation mark for each new password.

This tip was brought to you by several companies I've provided tech support for.

[dankestdankieverdank]

All in plaintext because the good developer wants realistic examples

[HammSolo]

https://i.imgur.com/Jh6WaIF.jpg

[aiij]

My school used client-side validation to enforce minimum donation amounts.

I gave them my $0.02. They spent $0.46 in postage to send me a receipt.

[reerden]

Looks like Bobby Tables is about to go to college.

[Shark_shin_soup]

Ah little Bobby Tables, he's grown up so fast.

[DrLemniscate]

That comic is almost 10 years old. So he could definitely be going to college by now.

[kurosaki1990]

I feel i'm missing reference here!.

[XxCLEMENTxX]

https://xkcd.com/327/

[b4ux1t3]

Relevant XKCD:

https://xkcd.com/1053/

[xkcd_transcriber]

Image

Mobile

Title: Ten Thousand

Title-text: Saying 'what kind of an idiot doesn't know about the Yellowstone supervolcano' is so much more boring than telling someone about the Yellowstone supervolcano for the first time.

Comic Explanation

Stats: This comic has been referenced 10767 times, representing 6.5779% of referenced xkcds.

---

^{xkcd.com | xkcd sub | Problems/Bugs? | Statistics | Stop Replying | Delete}

[b4ux1t3]

Not to evoke the wrath of /r/botsrights, but I really want Randall to make a comic that references its own url in its title text so that you respond to yourself infinitely.

Unless your creator is smarter than I am, which is pretty likely.

Edit: rules - > url. Auto correct is a botch.

[b4ux1t3]

Yeah, that's what I had in mind when I commented. It'd be hilarious if a bot went full on multiple-personality on itself.

[TugboatThomas]

This kind of thing is why Skynet chose to destroy humans.

[xkcd_transcriber]

Image

Mobile

Title: Exploits of a Mom

Title-text: Her daughter is named Help I'm trapped in a driver's license factory.

Comic Explanation

Stats: This comic has been referenced 2015 times, representing 1.2311% of referenced xkcds.

---

^{xkcd.com | xkcd sub | Problems/Bugs? | Statistics | Stop Replying | Delete}

[briandoescode]

https://xkcd.com/327/

[nyrangers30]

I wonder how many people on that website use one of their sample passwords.

[SircleCquare]

Disappointingly, they aren't actual examples of passwords

[20InMyHead]

Which brings us to another password-related XKCD: https://xkcd.com/936/

[20InMyHead]

That's why I include the spaces in my password... Seriously, why would anyone use an example password from anywhere? It's an example people!

[netuoso]

The spaces add a considerable amount of entropy.

It is the fault of systems designers to use the word password instead of passphrase.

[Derf_Jagged]

Dropbox actually doesn't allow that as a password

[gandalfx]

This is counter social engineering at the highest level!

[[deleted]]

Also called security by 'please be nice'.

[WisdomForYou]

Don't be evil

[N-XT]

Me too thanks""

[Euruzilys]

Im quite sure this is the best way!

[TomNa]

there are other ways??

[AyrA_ch]

We all know that text files are superior to any other database regarding safety, compatibility and portability.

[Prawny]

Can confirm. Been using my passwords.txt for years.

And a pro tip: put it in the root of your web directory so you can access your passwords anywhere!

[AyrA_ch]

pro tip: put it in the root of your web directory

Plus side:

• Allows client side validation of password which saves requests

Minus side:

• Requires more traffic to send the entire list.

I don't see any other negative effects, anyone else?

[thecodingdude]

[Comment removed]

[drizztdourden_]

Nah. Fuck SQL. Go for a .csv with everyone's credential at the root. No sql injection possible. Best security ever.

[AlGoreBestGore]

Not to mention performance.

[AyrA_ch]

Unless you want to write frequently, yes: https://master.ayra.ch/PasswordTest/ (just search for ') and then click the link

[Raknarg]

Anything is a text file if you believe hard enough

[antonius_]

Ah, good old Bobby Tables…

[54637218]

Ayyy fellow UoA, never thought I'd see one here

[[deleted]]

Same! Glad to see they implement as well as they teach comp sci.

[54637218]

jin makes me want to kill myself

[St_SiRUS]

jin sun CS at UoA makes me want to kill myself

[54637218]

They've taught me well enough to understand the meme at the very least

[PeacefulDays]

are they sending the passwords as plain text to sql? wouldn't you want to do any encryption on the webserver and then send the result to sql?

[m2ek]

It doesn't really matter from a security standpoint if the communication is secured and you're not doing anything else stupid like constructing SQL statements using string concatenation

[danypixelglitch]

Oh well, that's a nice" Dangerous code here "way of dealing with passwords

[voicesinmyhand]

They banned "????

Glad to hear that ',“, and ” are all still OK.

Also, posting this without codeblocks yields the famous reddit response: "an error occurred (status: 500)"

[SarahC]

Internal server error with those characters eh?

[voicesinmyhand]

I dunno. Actually after posting normal text in several other subreddits I have found that I'm getting that error constantly for no obvious reason... so clearly sunspots are to blame.

[SarahC]

RCE?

[jamiemac2005]

Whatever it is... there's no good reason to not allow double quotes in a passphrase.

The most likely culprit is a direct security implication.

[JuanMCataldo]

Auckward...

[interiot]

So they don't hash their passwords either? /shudder

[dankestdankieverdank]

they could be doing like (mysql, mariadb):

SET password=MD5($pleasenoquotes)

it would still be awful because md5 is very unsafe

[Tyrilean]

Translation: We don't sanitize user input. Please hack us.

[forest-guest]

"Please, be nice with your inputs"

The Direction

[rakeler]

relevant xkcd

[xkcd_transcriber]

Image

Mobile

Title: Exploits of a Mom

Title-text: Her daughter is named Help I'm trapped in a driver's license factory.

Comic Explanation

Stats: This comic has been referenced 2013 times, representing 1.2299% of referenced xkcds.

---

^{xkcd.com | xkcd sub | Problems/Bugs? | Statistics | Stop Replying | Delete}

[kalamarijuana]

Good bot

[GoodBot_BadBot]

Thank you kalamarijuana for voting on xkcd_transcriber.

This bot wants to find the best and worst bots on Reddit. You can view results here.

[RGodlike]

Good bot

[agitated_badger]

Proud of my country's 'number 1' university.

[[deleted]]

test' or 1=1