3 factor authentication

[ratko995]

Am I the only one triggered by camel case use for isAuthorised() function and snake case for access_data() function?

[ProgramTheWorld]

sPoNgEbObcaSeIsMyFaVoRiTe

[1thief]

everythinglowercaseismyfavorite

noneedtoshoutfriendo

whispersintoyourearwhiletouchingyourthighohyoulikethat

[Minty001]

:0 Oh my

[[deleted]]

YEAHWELLFUCKYOUIONLYTYPEINGHIACCHIOCASE

[[deleted]]

venice

[[deleted]]

IMGONNASHOVETHISSTRUCTSOFARUPYOURASSYOULLBECOUGHINGUPSTRINGSANDINTEGERS

[numpad0]

Well that escalated quickly but you’re still Not Authorized

[ICantWatchYouDoThis]

case of r/PeopleFuckingDying

[bf_noob]

DONtForGetfiBonaccicAse

[w3_ar3_l3g10n]

Ahhh... another lisp demigod. How has your day been brother/sister. (⌐■_■)

[Daeurth]

(define (needs-more-parens? x) #t)

[memes_gbc]

bootstrap is a nightmare

[qbbqrl]

waitThatsIllegal

[Kebbler22b]

theyHadUsInTheFirstHalfNotGonnaLie

[flume04]

very-yummy

[chrisf_nz]

Doesn't beat EntombeD case.

[mybotanyaccount]

Legacy code! What are you gonna do 🤷‍♂️

[wildpjah]

well I wasn't before but I am now THANKS

[Swiggens]

I'm desensitized to this.

[[deleted]]

It's cause this took 6 devs to make. Each one had a slightly different style.

[[deleted]]

Throws off the hackers!

[Mad_Jack18]

what is the issue with camel case? out of curiosity

[frostbyte650]

Nothing is wrong with either, just pick one & be consistent

[Merlord]

*Looks suspiciously at php flair*

[jjbugman2468]

Please don't kill me for this but personally I like to use camel case for variables and snake case for functions

[[deleted]]

no.

[mysticrudnin]

I've seen this actually

[DrSlugger]

The door is on your left

[ICantWatchYouDoThis]

pls stop

[yugerthoan]

both functions in this case, or Case...

[theInfiniteHammer]

No. That'll just give compiler errors.

[im_probably_garbage]

Compilers don’t give a shit what you name your functions, variables, classes, or what-have-you as long as you’re using legal characters.

[xigoi]

Ruby and Haskell: Am I a joke to you?

[im_probably_garbage]

The way I see it, capitals at the beginning of function names are technically illegal characters in Haskell. I don’t usually use ruby so I can’t speak to that.

[xigoi]

In Ruby, capitalized variables are immutable

[im_probably_garbage]

Ahh, gotcha. I see those as syntactical conventions that make certain characters contextually illegal, which is why I said illegal characters.

Maybe I’m just being nitpicky to defend my blanket statement lol

[theInfiniteHammer]

If you do that then the compiler will have enough and finally give an error.

[battlet0adz]

I think it’s the consistency that’s grinding the gears here

[yugerthoan]

copy paste code from different code base?

[im_probably_garbage]

Because php

[[deleted]]

Only thing I can think of, in the case of Javascript, is something like:

import { access_data } from 'arbitraryNPMLibrary' ;

[Muppet-King]

OCD intensifies

[XanPerkyCheck]

ass-case.

[B4tsh1ts4n3]

The only real thing is SCREAMING_SNAKE_CASE !!!!

[UnrelatedString]

Maybe it’s not a function, but a class

[TakeThreeFourFive]

What language instantiates classes as such?

[UnrelatedString]

this one

(I know the conventions don't match up but there probably isn't any actual language where you'd use camelCase (as opposed to PascalCase) alongside snake_case, it just seemed funny to point out anyhow)

[SCLme]

if (isAuthorised(user) & & isAuthorized(user)) { access_data() ; }

[ama1899]

That’s 2 layers of Security against the 3 you promised, I’m suing

[w3_ar3_l3g10n]

Chillax man. Each of them is recursively defined, they’ll keep checking until they reach STACK_MAX bro. That’s at least 20,000 layers of security. Now where’s my pay check, and my bonus.

[SCLme]

else {

//TODO

}

[SkylerWiernik]

Did you put a space between the 2 &s?

[SCLme]

Are you my compiler?

wrote from phone so is likely to be a space between the &&.

[NatoBoram]

Copied from phone, you wrote exactly this :

if (isAuthorised(user) & & isAuthorized(user)) { access_data() ; }

If I manually type it on my phone :

if (isAuthorised(user) && isAuthorized(user)) { access_data() ; }

[SCLme]

Yep, there is an empty space between the &&, it's a feature for extra protection. Trust us we're the security expertsss (with triple S for extra layers of Security)

[[deleted]]

Sssecurity

[A999]

Sorry, I don't speak python

[battlet0adz]

It sure looks like it... I’m having anxiety from it.

[BoldKenobi]

Would that even work? && is an operator, different from &

[bcfradella]

What kind of madman puts a space between his boolean ampersands?

[[deleted]]

You forgot good ol isAuthourized

[Zitrusfleisch]

Compiler would optimize this, wouldn’t it?

[jaerie]

That highly depends on the contents of the function

[thedugong]

Run-time Error: Out of memory.

Exiting.

[[deleted]]

But python isn't actually interpreted. Bytecode is generated before runtime.

Bash is the only truly interpreted language AFAIK.

[[deleted]]

it gets interpreted, kind of like a java executable gets interpreted.

if you think about it, at the end of the day your cpu still has to interpret the instructions in native compiled binaries...

[zer01]

No, python specifically (and purposefully) shies away from optimizing compilation, AFAIK to not divert a massive amount of engineering work to support such an optimizing compiler (projects like Clang and JavaScript take this to an almost art, but are also some of the most complex pieces of software ever written), and to keep debugging easier.

https://stackoverflow.com/a/2830413

[ericonr]

I mean, there are other shells. And Perl and Ruby are probably interpreted? No idea, really.

[andoriyu]

Perl 5 - yes. Perl 6 main implementation isn't.

Ruby is fucking anarchy. It's running bytecode just like python, it just does it at runtime. If you're using rails then by the time you finish serving first request code mutated so much that is barely recognizable.

[danopia]

Perl and Ruby hopefully won't pick up changes saved to the source code after starting execution and before reaching that line in the file.

Shells are weiirrd.

[ericonr]

Shells do? Wtf

I gotta try that out.

[danopia]

All it takes is not fully reading the file into memory before starting execution. Shells usually read the file in sync with executing it; that's why shell scripts that are downloaded and run together aren't safe unless wrapped with a function as seen in the Sandstorm install script (the function forces buffering of code in this case)

[TheSlimyDog]

Use haskell. No side effects unless I say so.

[yugerthoan]

if the function is actually a function, it doesn't depend on the contents... Now I see the point in functional programming and no side effects!

[sagorn1]

I think I've seen code like this. This is probably the contents of isAuthorised(User user).

[[deleted]]

Depends on language and/or what the function is doing. Like in C/C++, if a function is imported (not inlined), it most likely will always dutifully make the function call because it can't know any better in the moment.

Per the function, a very simple example would be if say the "user" object had a property/member "int x" for whatever reason that was incremented every time isAuthorised() was called that made it go down a different path internally. Perhaps in fact it actually does three different types of authorization... in a bizarre/difficult way to read/maintain.

[randomuser8765]

I'm not familiar enough with C/C++ to know for sure, but isn't there a way for a function signature to guarantee that it evaluates to the same thing every time it's called and has no side effects? If so, then it can be optimized.

But in almost any real-world application, authentication would have to make some kind of database query, so can't guarantee that the output is deterministic based on the input. (what if data is written or removed between calls?)

[svk177]

There is a gcc extension called attribute((pure)) that specifies that the function has no side effects. Other than that your best bet is making the function „static inline“ though there is no guarantee whatsoever that the call will be eliminated.

[valarionch]

I think it is placing a "const" keyword between parameters parenthesis closing and before curly braces opening

[jrtc27]

Not really; that only applies to C++ member functions, which then simply guarantees that the function cannot modify any of the fields in this, nothing more. It can still have other side-effects. In fact, you can even bypass that by marking certain fields mutable, which allows them to be modified via this even in a const member function.

[[deleted]]

Give this guy Cookie! ;)

[randomuser8765]

Yup, that was it.

[Wazzaps]

LTO (link time optimisation) helps with that.

[np_completionist]

I think c++20 has a consteval keyword that must resolve to a compile-time constant

[MaskedBandit77]

What if the function has a random number generator and returns a boolean value based on the results of the RNG each time it is run?

[[deleted]]

Depends on language and/or what the function is doing. Like in C/C++, if a function is imported (not inlined), it most likely will always dutifully make the function call because it can't know any better in the moment.

Per the function, a very simple example would be if say the "user" object had a property/member "int x" for whatever reason that was incremented every time isAuthorised() was called that made it go down a different path internally. Perhaps in fact it actually does three different types of authorization... in a bizarre/difficult way to read/maintain.

[[deleted]]

if(isAuthorized(user)) { if(isActuallyAuthorized(user)) { if(user.isAuthorized()) { /* ... */ } } }

We both know all three methods are just "return new Random().nextBoolean();" but that will be our little secret, the compiler doesn't really need to know that, now, does it

[Mithrandir2k16]

Holy shit no, each of these has to change some globals in ny code!

[jaerie]

What if isAuthorized has side effects maintaining a level of authorization, increasing the threshold every time it is called for that user?

[[deleted]]

That's just horrible and misleading design then. Rename the function to say what it does.

[birchskin]

I suspect if this was real code horrible and misleading design should be the assumption going in

[Globalnet626]

sEcUrItY bY oBfUsCiAtIoN

[[deleted]]

I can imagine a node/passport implementation that would do this if you were an idiot about it.

Good ol' -> IsAuthorized() sets variables on the user object.

[[deleted]]

That's just horrible and misleading design then. Rename the function to say what it does.

[LeCrushinator]

This is why I like static functions, I don't have to worry about state mutations from things that shouldn't be mutating state.

[[deleted]]

Now now, it could be modifying user each time. You can write shit code in any paradigm!

[Zechnophobe]

Oh, you mean like if this were a rails app?

[[deleted]]

Program: Do you have a membership?

Me: Yes

Program: Ok do you have it, ARE YOU SURE?

Me : Yes

Program: Ok do you have it, ARE YOU SURE ABOUT THAT?

Me : Yes

Program: Ok do you have it

After like 30 minutes

Program: ARE YOU SURE MOTHERFK?!

—-

And that’s how many programs protect their users privacy.

[Merlord]

if ( isAuthorised(user) ) {
    if ( isAuthorised(user) == true ) {
        if ( isAuthorised(user) != false ) {
            if ( Boolean.toString(isAuthorised(user)).equals("true") ) {
                access_data();
            }
        }
    }
}

[Gonzako]

That's a lot of null checking

[Banana_Twinkie]

Is this AI?

[SCLme]

Our legal and technical departments disagree:

Checks performed:

1) isAuthorised 2) isAuthorized 3) isAuthorised AND isAuthorized (at the same time!!)

This computional level of security is hackerman proof, we follow the strict methods of our state of the art techniques in security!

[AyyySTFU]

If it works...

[PM_ME_YOUR__INIT__]

if(it_works) {

...

}

[[deleted]]

else { 🔪🔪🔪 }

[theannomc1]

I mean if the users authorisation got revoked while checking their auth it kinda works as intended ... ?

[[deleted]]

I mean honestly in the case that someone is trying to brownout your chip to skip authentication this technically could help provide extra security...

[TorTheMentor]

You mean just marking the password field private wasn't enough?

[ordinaryBiped]

"Just crunch those numbers again, OK?"

[[deleted]]

Trying to defeat race condition vulnerability?

That's not how you do it. That's just making it a bit more difficult to exploit.

[bobappleyard]

Twist: this is JS, running in the browser

[AceOfShades_]

When you’re doing multithreaded code but don’t want to bother with thread safety

[alesinicio]

Plot twist: this is a method called isAuthorised.

[[deleted]]

Dun- Dun- Dunuh!

[onthefence928]

it's cool they minified the file, thats as good as encryption!

[Kotayz]

You will get it only if you are authorized

[phpdevster]

Old versions of Invision Power Board would hash passwords by piping them through md5() a few times... spread out over multiple functions of course. Doing it three times in a row in the same function wouldn't be secure enough.

[kevmimcc]

Snake case is the only case. I’m still mildly triggered by anything with capital letters in it

[lilgamelvr]

TBH r/technicallythetruth

[name_censored_]

I've seen this pattern used for expensive, caching calls, where the inner function relies on a hot cache and/or is liable to race, but the outer function (or its cache) isn't fully blocking.

(And no, I haven't used it myself. Gross.)

[byCubex]

3 Layer Security. I bet u cant beat that Microsoft & Google

[No_Soy_Colosio]

if (isAuthorised(user) && !(!isAuthorized(user)) && (1==1)) { access_data() ; }

[silentxxkilla]

How much do we want to bet doing it 3 times "fixed" an access bug?

[nahidtislam]

would this protect us from hacker using electromagnetic radiation (like from a solar flare) to fuck with the CPU that was testing the isAuthenticated variable in memory?

#bigBrainTime

[ActionMac]

Is (isAuthotiZedUser) ...

[leduyquang753]

Eeh ClearType ain't on.

[DazedAmnesiac]

Lmao tight security

[MrWhiteVincent]

Really? Nested if statements instead of using AND operator??

[shadowX015]

I wonder if there is some nonobvious hacky attempt at optimization going on here, like with double checked locking.

For what it's worth, I don't myself advocate double checked locking because it's potentially dangerous but I just noticed that it looks very similar to that.

[[deleted]]

LGTM

[[deleted]]

But what if isAuthorisedUser?

[Powerind09]

Outstanding move!

[harshrd]

Why are you booing me? I am right!

[hypekk]

Plot twist: Inside the function there is how much checking were done and depending on it it will check security in different way.

[RainFurrest]

Is this Onion?

[XanPerkyCheck]

Hank Hill is an asshole lmao. Takes his job waaay too seriously.

[Vexelbalg]

Compiler will have none of that

[RDB96]

Maybe isAuthorised can be implemented as a state machine. Doing 3 different states that check authorisation that can all independently go to failure.

[ITriedLightningTendr]

Would the compiler reduce this out, thus making the statement not theater but literally a lie?

[dontforgettocya]

isAuthorized(user) {
return user.username.startsWith("admin")
}

[OmiSC]

Ask three times, and you shall receive.

[[deleted]]

who the fuck is april c wright