|
Hey.
I am building an application where there will be different 'users', each with a username and password. The application is using a webservice (Amazon S3) which requires a logon also. It is envisaged that a company buys an S3 account, and allows it's users to utilise it through an application. The users can store and delete files on their part of S3. Each user would only have access to their own files, etc. Deciding who's files belongs to who is a different issue.
Anyway, so if, say, Joe logs into the application, his password is checked against a database on a central sever, and upon authentication, the S3 'access ID' and 'secret access ID' is sent to the application, which then uses it to log on S3. The users password would initially be MD5'd, and then sent to the server for authentication. (The database will hold MD5'd passwords).
So my first question is: What's the best way to get the 'access ID' and 'secret access ID' from a central server, to the user? Obviously, to keep it secret it would need to be encrypted. The application can be ran on any machine, so a key cannot be stored, say, in the registry. I was considering encrypting the S3 access/secret id string with an MD5 of the users password, but that'll be sent over the network too, and itself will be exposed. Please, any ideas greatly appreciated???
Next, then Joe wants to upload files.
I am looking for any suggestions on how to encrypt these files, using a different key for each user. So, for example, a company admin couldnt go onto the S3 service, and look at a users files, without knowing the encryption/decryption key. Again, I was considering using an MD5 of the users password as an encryption/decryption string, but this itself poses the problem whereby a user changes password.
My main problem is how to get a string from the server to any PC, but for it not to be exposed on the network.
Any help in this whole area is much much much appreciated.
Regards,
Cormac Redmond
|
|
|
|
|
Cormac M Redmond wrote: The users password would initially be MD5'd, and then sent to the server for authentication. (The database will hold MD5'd passwords).
MD5 is broken. Consider using SHA256 of SHA512. Also you might want to consider using a salted hash. This means adding some additional random data on the front of a password before it is hashed so that in the event that two users happen to have the same password it isn't obvious by looking at the resulting hash values. The salt is stored in plain text in an additional column in the database. The salt being in plain text has no value to an attacker because its function is solely to remove the ability to detect duplicate passwords. A brute force attack would still be necessary to break the password. When a user types their password the salt is added to the password as before, then it is hashed and the salted hash values are checked.
Cormac M Redmond wrote: So my first question is: What's the best way to get the 'access ID' and 'secret access ID' from a central server, to the user? Obviously, to keep it secret it would need to be encrypted. The application can be ran on any machine, so a key cannot be stored, say, in the registry. I was considering encrypting the S3 access/secret id string with an MD5 of the users password, but that'll be sent over the network too, and itself will be exposed. Please, any ideas greatly appreciated???
Consider the use of public/private key encryption. The basic idea is that anything encrypted using the public key can only be read by the holder of the private key. Anything encrypted with the private key can be read by anyone with the public key. The former could be useful for your purposes, the latter is useful when you want to authenticate where something has originated.
So, you decide on an asymetric encryption algorithm, you send the issuer of the access/secret id your public key. When the data comes back, you are the only one that can read it because you have the private key. It doesn't matter than anyone can see the public key because it is no use to them.
Cormac M Redmond wrote: I was considering using an MD5 of the users password as an encryption/decryption string, but this itself poses the problem whereby a user changes password.
You also have the problem that you are using a key that can be discovered. If you are using a hashed version of the password as the key, then the admin doesn't need to know the password, just the hashed value. They can then attack the file/database directly without going through the application.
This leads in to the same problems as you have with DRM systems. The key and the encrypted data end up in the same place at the same time with the party you do not trust.
|
|
|
|
|
Thanks. That's all very helpful!
I'm slightly confused regarding the salting. Is this how it should work? Say, I try to login to the application from any P.C.:
Username: Cormac
Password: Redmond
Would the application tell the server to get the salt key from the table where, say, username = Cormac?
And then send the salt key BACK to the application, which would then creat the salted hash value and send back to the server for authentication? *breath*
Therefore, when creating the salts and populating the database, there would be checks that none of them are the same, thus there never being similar hash values?
Also, could you recommend a suitable public/private key encrpytion algorithm? RSA...Diffie-Hellman?
Thanks for the help.
Regards,
Cormac Redmond
-- modified at 0:03 Monday 1st January, 2007
|
|
|
|
|
Cormac M Redmond wrote: Therefore, when creating the salts and populating the database, there would be checks that none of them are the same, thus there never being similar hash values?
If you use a GUID as a salt value you are virtually guaranteed uniqueness. You'd have to generate billions-upon-billions of GUIDs before you'd get a collision - in fact the number is closer to 2.5 * 1038 (250 undecillion) - If you had all the PCs in the world cranking out GUIDs constantly it would still take a heck of a long time.
You can also use something simpler. Like the primary key of the row in the database - since a primary key is guaranteed to be unique it could be a good candidate.
Typically, I just use a random number generator to generate a random sequence of bytes.
Cormac M Redmond wrote: Also, could you recommend a suitable public/private key encrpytion algorithm? RSA...Diffie-Hellman?
You may want to take a look at this entry on Wikipedia[^]. It will help you choose an algorithm that is suitable. From this point you make also find other useful information about cryptography.
One thing to remember about public/private key cryptography is that they are computationally expensive when compared to symmetric encryption - so they are only ever used to encrypt small pieces of data, often they are used to encrypt symmetric keys.
|
|
|
|
|
I wonder why good informative posts like this get only my vote of 5?!!Why don't CPains vote in favour of a post anymore -only voting ones and twoes-?
Thanks Colin. Even though I didn't ask the question, but I've been really pleased by reading your well said, well organized post.
Regards ![Rose | [Rose]](https://codeproject.freetls.fastly.net/script/Forums/Images/rose.gif)
|
|
|
|
|
I didn't even know you could vote, if you're reffering to me! 
|
|
|
|
|
Oops!:-> I didn't even imply it.. I just noticed this for some weeks that many good posts don't get high votes anymore -excpet mine if I were around-, and I was a bit frustrated. Forgive me if you got offended. I really didn't mean you Personally.
Regards
|
|
|
|
|
Hehe. I wasn't offended.
Anyway, at least now I know! 
|
|
|
|
|
Nader Elshehabi wrote: Thanks Colin. Even though I didn't ask the question, but I've been really pleased by reading your well said, well organized post.
Thank you. I very much appreciate your compliment.
|
|
|
|
|
Hi.
I have problem storing a composite structure in MS Access using relations. The class structure looks like this:
http://www.web-tech.dk/CompositeStructure.jpg[^]
It uses a composite design pattern.
Any ideas?
Programming is like Mathematics… you take ONE step at the time!
|
|
|
|
|
I am not sure you can do this in ms access. I would try the vb forum since you would be using vba which as far as I know will not support the use of classes in the way you are trying.
Just curious as to why you are trying to do this in ms Access when there are so many OO languages avalilable?
|
|
|
|
|
|
hi
i have a login control to my page, it's work good,but when i at runtime set RememberMe checkBox to true and refresh page or recompile it, the
checkbox is empty and not remember me, how to solve this problem ?
Note : my problem was solved by this Article :
http://www.codeproject.com/useritems/Remember_me_next_time.asp
but when i run my Page the following error has shown me on this line :
protected void Page_Load(object sender, EventArgs e)<br />
{<br />
this.Login1.Focus();<br />
if (!IsPostBack)<br />
{<br />
if (Response.Cookies["myCookie"] != null)<br />
{<br />
HttpCookie cookie = Response.Cookies.Get("myCookie");<br />
string emailID = cookie.Values["Email"].ToString(); -> Object reference not set to an instance of an object.<br />
string pass = cookie.Values["Pass"].ToString();<br />
<br />
if(Membership.ValidateUser(emailID,pass))<br />
{<br />
System.Web.Security.FormsAuthentication.RedirectFromLoginPage(emailID,true);<br />
}<br />
}<br />
}<br />
}
thank
|
|
|
|
|
hi there,
i am trying to automate login using httpwebrequest it does all the work correctly but when i try to redirect to the welcome page with the cookie headers that i got from the last post it redirect me to login , this is my code, any help plz?
// making post with login data
PostData = "login_username=clude&secretkey=taamea&js_autodetect_results=1&just_logged_in=1";
Url = "http://webmail.cleanercorners.com/src/redirect.php";
sReferer = "http://webmail.cleanercorners.com/src/login.php";
webRequest = (HttpWebRequest)WebRequest.Create(Url);
webRequest.Headers["Accept-Language"] = "ar-eg"; //"en-us"; //ar-eg
//webRequest.ProtocolVersion = HttpVersion.Version11;
webRequest.AllowAutoRedirect = false;
webRequest.Referer = sReferer;
webRequest.KeepAlive = true;
//webRequest.ContentType = "";
webRequest.UserAgent = " Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)";
webRequest.Accept = "image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*";
// making a post
ASCIIEncoding encoding = new ASCIIEncoding();
encodedPostData = encoding.GetBytes(PostData);
webRequest.Method = "POST";
webRequest.ContentType = "application/x-www-form-urlencoded";
webRequest.ContentLength = encodedPostData.Length;
Stream requestStream = null;
requestStream = webRequest.GetRequestStream();
requestStream.Write(encoding.GetBytes(PostData), 0, PostData.Length);
HttpWebResponse webResponse = (HttpWebResponse)webRequest.GetResponse();
requestStream.Close();
// getting the cookies from the response
cookies = res.Headers["Set-Cookie"] ;
string[] sCookiesParts = cookies.Split(new char[2] { ';', ',' });
string sFormatedCookies = sCookiesParts[0] + ";" + sCookiesParts[2] + ";" + sCookiesParts[6];
//HttpCookie cookie1 = new HttpCookie("Cookie", sFormatedCookies);
//Response.Cookies.Add(cookie1);
// redirect with cookies
Response.AddHeader("Cookie", sFormatedCookies);
Response.Redirect("http://webmail.cleanercorners.com/src/webmail.php");
|
|
|
|
|
hi
i want to ececute some commands in command prompt (like ipconfig or ping ip or ....) and get result from it (command prompt) and use in my app, but how to do ?
thanks
|
|
|
|
|
You can use the System.Diagnostics.Process class for this (redirecting the standard output). A detailed example is available here:
MSDN: Process.StandardOutput[^].
|
|
|
|
|
Hello everybody .
i just need to know the following:
==================================
1 - i have ADSL connection , i need to make my ip address globally accessible , On Dial up connection my ip address was globally accessible by other users on the internet but not on ADSL , i just need to know how and if using port forwarding ( i need a total explanations or links for explaining that step by step ) knowing i tried the article here on codeproject on port forwarding but it didn't work with me , i don't know why.
Human knowledge belongs to the world.
|
|
|
|
|
Usually with an aDSL connection you are given a private address and that is mapped to a global address by your ISP.
To verify, go to start run and type cmd and then ipconfig
There you will see your ip address. (private ranges start with 10. or 172.16. or 192.168. and so on)
Have a look at http://www.ippages.com/ to see your real ip address. This is the one everybody can see.
If that ip works for you, then you should need anything more configured.
If you have a router you can either make manual port forwarding and/or UPnP
Read about those http://en.wikipedia.org/wiki/Universal_Plug_and_Play and http://en.wikipedia.org/wiki/Port_forwarding
Hope i could help
And a good place to learn how to port forward on alomost any device http://portforward.com/
|
|
|
|
|
In Belgium the basic ADSL subscription gives you a different IP address every time you
log on to the ISP; a premium subscription is required if you want your IP to be
constant (so you can set up a publicly available server).
Luc Pattyn
|
|
|
|
|
Dear Friends,
How to connect SFTP(Secure FTP) using C# code?
Regards,
Sireesh
-- modified at 4:17 Sunday 31st December, 2006
|
|
|
|
|
Hi,
I have a listview with check boxes enabled. I want to delete the item when the check box is toggled.
I am happy to do this immediately or on a button control that goes thru the listbox and deletes all the checked items.
I have searched the net high and low and cannot find how to pass the index of the selected items to the delete line as in the following examples:
this.listView1.CheckedItems[a].Remove();
OR
this.listView1.SelectedItems[a].Remove();
How do I determine the index of the item to be removed?
Glen Harvy
|
|
|
|
|
Hi!
I think there's a little misconception on your side: You don't want to remove an item from the list of checked or selected items but from the listview's item list itself.
So you could write something like this:
foreach (ListViewItem it in listView1.CheckedItems)
listView1.Items.Remove(it);
Regards,
mav
--
Black holes are the places where God divided by 0...
|
|
|
|
|
Thanks for that.
Much appreciated.
Glen Harvy
|
|
|
|
|
In my app, I create event handlers for events supplied by iTunes, like this:
itunes.OnDatabaseChangedEvent += new _IiTunesEvents_OnDatabaseChangedEventEventHandler(itunes_OnDatabaseChangedEvent);
When I no longer want to get these events, how do I do this?
I could simply set a flag and stop reacting to the events, true. But is there a more graceful way? In fact, is there a way to indicate that I no longer want the events sent?
In fact... what causes me to start receiving the events in the first place? Is it the creation of the handler, or did I start getting the events as soon as I created the iTunesApp instance?
At any rate, thanks in advance for your information.
|
|
|
|
|
You registered for receiving the event using +=. If you don't want to be notified any more, simply use exactly the same line, but with the -= operator.
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
