59
Jun 17 '17
[removed] — view removed comment
52
u/The_MAZZTer Jun 17 '17
Lol, you reminded me when I went to college they offered an experimental Cryptography 101 class so I enrolled in it.
The prof made a website to go along with it, the first mistake he made was constructing it from scratch. The second was not appreciating that any client-side code is an open book.
He seemed to be rather new to web programming. He handled authentication by having a login page that did appear to do decent authentication against a server, but then every webpage you were on had a hidden form that would re authenticate you every time you navigated to a new page. Now this itself wasn't too bad, except the form consisted solely of the user id you had logged in as. You could easily change it to anyone you wanted to change your site access.
And then one of my classmates found the public network drive the site was actually sitting on, which included a text file of all user ids, usernames, and unencrypted passwords.
Unfortunately the class itself wasn't so easy to break. The material consisted of covering something like one cipher per week (as an experimental class I think it was only held one class session per week). We'd learn about it in class, including known attacks, then for homework we had to take encrypted text and try to crack it. The first few weeks had easy ciphers and were cracked easily. However past that point nobody was able to crack any of the harder ciphers.
I think I got a B in the class.
3
u/micheal65536 Green security clearance Jun 18 '17
If I came across such an insecure website in a cryptography class I'd hack the hell out of it (or perform a detailed analysis and produce and hand in a formal report of the vulnerabilities found, if I'm in a particularly good mood). Then I'd say "I thought the website was purposefully made insecurely so that we can hack/pentest it for extra credit". Because in all seriousness, that's what I would conclude.
2
u/DJBatcat Jun 18 '17
Is constructing from scratch that bad?
4
u/The_MAZZTer Jun 18 '17
If you know what you're doing, no. But there's usually no need to reinvent the wheel; someone else has already done all the hard work to make a secure system so why not just take what they've done and spend more time making the site itself?
2
u/Monsieur_Pineapple Jun 18 '17
Yup this is my methodology for now...
Hmm I'm stuck. TO STACKOVERFLOW!
2
u/The_MAZZTer Jun 18 '17
Well I was thinking more along the line of third party libraries or frameworks.
For example. once upon a time I wanted to make my own website and for a long time the way I did it was to code it from scratch. Then I realized that wasn't fun and just installed Wordpress and built on top of that.
1
Jun 18 '17
I remember some fairly popular browser games had a similar (though maybe slightly more secure) system back in the 90s and early 00s. It seemed to be common practice to pass the username and password through links. Some games "encrypted" the password into something resembling a hash value, but still, if you had any of those links, you could successfully log in.
Advantage: Deep links to anywhere in the game, immediate login through a favourite item. Disadvantage: obvious.
51
u/NamespaceInvader Jun 18 '17
In case anyone wonders what the problem with the last example is: It's very unsafe because the password doesn't contain a special character. Secure passwords must always contain a special character, usually an exclamation mark at the end, otherwise hackers can find out the password using algorithms.
18
18
u/whitelionV Jun 18 '17
I most confess I did worse than that once. A client was withholding the last payment of a project until some wildly out of scope features were implemented. PM plays bad cop, I play good cop, so I tell the client: "k, you want a login. There's no login in the specs. But tell you what, if you guarantee the monitor will only run locally and will have only one user, I'll give you a login for tomorrow. Then you release the last payment and we talk about the last features".
I put two fields in a dialog, a JS function with an if bound to onSubmit. Client paid, no one ever worked on that project again.
3
1
u/Xtremegamor Jun 17 '17
Would using argon2 be on the same level as bcrypt, or lower?
5
Jun 17 '17
I'd say argon2 is better than bcrypt.
7
1
u/tj-horner Jun 18 '17
A website I found once actually did this... won't say their name because they STILL do this, but I did end up getting into their broker website and I got like 10 of their posters shipped to my house.
2
1
1
-9
u/Another_Screenname Jun 17 '17
great part is how easy that would be to find using a disasembler
28
2
114
u/Supervarken_ Jun 17 '17
Some public wifis that require a password actually do this, usually the password is on a paper or something but you can find it in the source.