|
I guess just about all of us have now heard about the heartbleed bug[^].
From the rather massive media coverage it appears that this can be exploited in ways that allows an attacker to potentially retrieve logon information such as user names and passwords.
If this is possible, it also means that the actual password, and not a cryptographic digest, has been sendt to the server - and that the actual real password is kept in memory, and that it is either stored locally by the server, or the server can retrieve the password from another server on the network, or farward it to another server for authentication.
Even if there was no heartbleed bug, this sounds like a f***up on a much grander scale than the heartbleed bug, because it makes it likely that a lot of people believe they have implemented strong security, while actually implementing something that is quite vulnerable.
Thoughts anybody? or jokes (if you can come up with good ones)
[Update]
Just to be clear: I think we should allways use transport level security, and even then we should never send the password in a form that can be easily reconstructed.
modified 14-Apr-14 6:00am.
|
|
|
|
|
Obligatory XKCD link[^].
Espen Harlinn wrote: Thoughts anybody? or jokes
Covering all bases here.
|
|
|
|
|
|
Go to QA, and you will see that the "next generation" of developers not only store clear text passwords, but that they access them by concatenating strings:
string sql = "SELECT * FROM Users WHERE UserId='" + tbUser.Text + "' AND Password='" + tbPassword.Text+"'"; So not only is the site vulnerable to Heartbleed, but SQL Injection and password bypass. So if I type:
Chris Maunder';-- in the Username textbox, I could log in as the Admins...(Needless to say, that won't work here on CP!)
Worse, if you pick them up on it they give the keyboard equivalent of a shrug and ignore you... 
Those who fail to learn history are doomed to repeat it. --- George Santayana (December 16, 1863 – September 26, 1952)
Those who fail to clear history are doomed to explain it. --- OriginalGriff (February 24, 1959 – ∞)
|
|
|
|
|
OriginalGriff wrote: developers
Feeling generous are we? More like "copy/pasters". 
|
|
|
|
|
To you and I (and the majority of Lounge inhabitants) they are "copy'n'paste" merchants.
To themselves, and their lecturers - and worse, their bosses - they are developers par excellence! 
Those who fail to learn history are doomed to repeat it. --- George Santayana (December 16, 1863 – September 26, 1952)
Those who fail to clear history are doomed to explain it. --- OriginalGriff (February 24, 1959 – ∞)
|
|
|
|
|
I think you have way too less confidence in your abilities. Just because you know you are worse than me, you cannot call me names.
|
|
|
|
|
OriginalGriff wrote: developers par excellence!
Unfortunately, all too true. I know of at least 2 members that have been here for multiples years. One such person has gotten his entire application written by copying and pasting code around in questions getting people to write and rewrite his code for him. Even more sadly, this person cannot write code, cannot debug his code or anything else (by his own admission BTW), but for some strange reason, thinks he is qualified to teach students how to program! WTE?
I have said it before and I will say it again, Griff my old friend, you Sir could probably teach Job a thing or two. I don't know how you do it. But my hat is off to you!
|
|
|
|
|
OriginalGriff wrote: Worse, if you pick them up on it they give the keyboard equivalent of a shrug and ignore you...
I know - and they'll continue to get paid for it ... it's like 2013 never happened[^]
|
|
|
|
|
OriginalGriff wrote: So if I type:
Chris Maunder';-- in the Username textbox,
Uh, 'Griff? Can I have my password back now? Please?
cheers
Chris Maunder
|
|
|
|
|
Oh... All right... 
Those who fail to learn history are doomed to repeat it. --- George Santayana (December 16, 1863 – September 26, 1952)
Those who fail to clear history are doomed to explain it. --- OriginalGriff (February 24, 1959 – ∞)
|
|
|
|
|
Espen Harlinn wrote: If this is possible, it also means that the actual password, and not a
cryptographic digest, has been sendt to the server
The way I read it is that the key pair can be read and thus the pwd decrypted. So the pwd is stored in an encrypted form so it doesn't look as bad as you think.
At least that's my take, but I don't know jack about security stuff.
"The whole idea that carbon dioxide is the main cause of the recent global warming is based on a guess that was proved false by empirical evidence during the 1990s." climate-models-go-cold
|
|
|
|
|
Munchies_Matt wrote: so it doesn't look as bad as you think
Errhm ... hearbleed lets you read memory from the server:When it is exploited it leads to the leak of memory contents from the server
There shouldn't be any passwords to read from the memory on the server - only the cryptographic digest, which, on it's own should be worthless ...
|
|
|
|
|
Referring to a SoapBox thread I read today, if it ain't got to do with kernel, it is stupid.
|
|
|
|
|
Your link says as much "This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet"
It doesnt say stealing passwords, it says stealing the encryption keys, and thus decrypting the traffic and thus effecting a 'man in the middle' attack.
Espen Harlinn wrote: which, on it's own should be worthless
See 'man in the middle' attacks.
"The whole idea that carbon dioxide is the main cause of the recent global warming is based on a guess that was proved false by empirical evidence during the 1990s." climate-models-go-cold
|
|
|
|
|
Espen Harlinn wrote: There shouldn't be any passwords to read from the memory on the server - only the cryptographic digest, which, on it's own should be worthless ...
Hashed passwords (even salted) can be cracked much faster than you think in may cases because people are bad at generating randomness. As such by going through likely passwords it is possible to crack thousands of passwords in a few hours.
|
|
|
|
|
J. Adam Armstrong wrote: As such by going through likely passwords it is possible to crack thousands of passwords in a few hours.
That's certainly true.
|
|
|
|
|
Espen Harlinn wrote: There shouldn't be any passwords to read from the memory on the server
What happens when someone logs in? The password is sent to the server (over SSL) and so the server may have have it in a variable in memory for a period of time. How long the variable lives depends on the platform and scope (Allocated on the stack? Allocated on a memory managed heap? Static buffer constantly being overwritten?)
cheers
Chris Maunder
|
|
|
|
|
You mention several things that have been used to crack security in the past.
As usual xkcd got it right: Heartbleed Explanation[^]
What makes heartbleed unique is not the bug in itself, it's the number of systems that are affected.
We've seen bugs that allow server memory to be read before, and it's highly likely that we will see them again.
Now, lets head over to the wonderful world of automation where systems are, as a rule of thumb, never patched.
Many Devices Will Never Be Patched to Fix Heartbleed Bug[^]
|
|
|
|
|
I have had LinkedIn account for some time. I don't care too much about security issues anymore.
|
|
|
|
|
I guess you tried for a joke - and being perhaps a bit slow tonight, I'm having a bit of a struggle ...
|
|
|
|
|
The issue is that it is in the SSL protocol which is usually safe. Because of that passwords are not typically hashed in javascript on the client, but the hash is generated on the server. That's why the servers might have passwords in memory. The bigger issue is that someone might have gotten the server's private key and been able to decrypt all the traffic to the server.
|
|
|
|
|
|
It may be time to change to a new host.
It may be time to renew with my existing host.
If I change, I can save significantly. (75%)
If I stay, I will...
-- remain with a host with which I am familiar
-- pay about twice what I paid for the signup deal
-- pay about four times what the EL-Cheap-O places are offering
I changed to this host due to various reasons, and I'm glad I did.
I learned about lower costs, and I like them
Now their costs are going up as high as the previous host, which makes the advantage approximately gone.
So far, my website(s) have been super low traffic and almost zero upkeep.
Question One: What do the experts here think ?
Question Two: There are one zillion hosting companies; where do I read the opinions of those who use them ?
(preferably, those who are currently using multiple hosts for multiple sites)
Question Three: is there a better place than the lounge to have this discussion ?
----EDIT----UPDATE----
Responses have indicated that my original post lacked needed info.
I have...
About 50 domain names; maybe 75; haven't counted.
About 100 or 200 E-mail addresses; again, haven't counted. The vast majority (90% easily) of those are just E-mail forwarding addresses; I use them for spam paranoia.
As time progresses, I want to host two or three small focused forums.
These forums will grow to millions of users and make me rich without any work (oh yeah)
modified 17-Apr-14 8:13am.
|
|
|
|
|
000webhost by a mile.
I know some people are wary of free stuff, but I've been with them for years and they have excellent uptime, features, bandwidth, and hard-drive space for low traffic websites.
Only annoying things about them:
1. If your traffic is really, really, really low (like 1 hit per month), or you don't sign into their membership portal every few months or so, they may pop an advert (advertising themselves) on your pages, despite their no-ads policy. Nothin' a bit of my hackish JS couldn't fix though...  
2. They don't support ASP.NET.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
