Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.c++ > #72063
| From | "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> |
|---|---|
| Newsgroups | comp.lang.c++ |
| Subject | Re: Regal eagle / American cloud |
| Date | 2020-02-28 23:38 -0800 |
| Organization | Aioe.org NNTP Server |
| Message-ID | <r3d4ds$816$1@gioia.aioe.org> (permalink) |
| References | (5 earlier) <W9l6G.466483$Uz.342441@fx32.am4> <r3ct34$18p9$1@gioia.aioe.org> <fwn6G.54127$_h7.15094@fx13.ams1> <r3d0kv$1nc1$1@gioia.aioe.org> <DRn6G.1466760$GFe.1466664@fx12.am4> |
On 2/28/2020 10:51 PM, Melzzzzz wrote: > On 2020-02-29, Chris M. Thomasson <chris.m.thomasson.1@gmail.com> wrote: >> On 2/28/2020 10:28 PM, Mr Flibble wrote: >>> On 29/02/2020 05:33, Chris M. Thomasson wrote: >>>> On 2/28/2020 7:48 PM, Melzzzzz wrote: >>>>> On 2020-02-29, woodbrian77@gmail.com <woodbrian77@gmail.com> wrote: >>>>>> On Friday, February 28, 2020 at 5:37:35 PM UTC-6, Chris M. Thomasson >>>>>> wrote: >>>>>>> On 2/27/2020 8:19 PM, woodbrian77@gmail.com wrote: >>>>>>>> On Sunday, February 9, 2020 at 2:54:28 PM UTC-6, Chris M. >>>>>>>> Thomasson wrote: >>>>>>>>> On 10/30/2019 9:58 AM, woodbrian77@gmail.com wrote: >>>>>>>>>> Shalom >>>>>>>>>> >>>>>>>>>> Can you give me some suggestions on how to improve my >>>>>>>>>> repo: https://github.com/Ebenezer-group/onwards >>>>>>>>>> ? >>>>>>>>>> >>>>>>>>>> What do you think of recent changes to this file? >>>>>>>>>> https://github.com/Ebenezer-group/onwards/blob/master/src/cmw/tiers/cmwA.cc >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> and a version from the end of September: >>>>>>>>>> https://github.com/Ebenezer-group/onwards/blob/9bc4c2646e7dc6421dfdcd9d1107d544c320a13a/src/cmw/tiers/cmwA.cc >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> The number of lines hasn't changed much, but the size of the >>>>>>>>>> event loop, the most complicated part of the program, has been >>>>>>>>>> reduced by switching from TCP to SCTP. Thanks in advance. >>>>>>>>> >>>>>>>>> Iirc, you require a user to "register" by sending you an email with >>>>>>>>> their password in the clear? >>>>>>>> >>>>>>>> I plan to use Wireguard for encryption so it >>>>>>>> could be done after we have that set up. >>>>> >>>>> sending passwords over mail is highly unsecure. No one does it any more. >>>>>>> >>>>>>> How are you storing those user passwords on your end? I hope your not >>>>>>> storing them in the clear... You can store the HMAC'ed result, keyed >>>>>>> with a salt or some random element. Then instead of comparing >>>>>>> passwords >>>>>>> in the clear, you can compare hash digests. >>>>>> >>>>>> OK. I'm also thinking about this: >>>>>> https://www.reddit.com/r/WireGuard/comments/ewzxk4/no_password_protection_at_all/ >>>>>> >>>>>> >>>>>> Perhaps I don't need passwords beyond what Wireguard provides. >>>>> Hm, no password is something like sending public keys? >>>> >>>> Very Simple scheme... >>>> >>>> Password Setup: >>>> >>>> Use DH to setup temporary secure channel between server and a client. >>>> >>>> The client encrypts the password using this session and sends the >>>> ciphertext to the server. >>>> >>>> The server decrypts and hashes the password with a random salt. >>>> >>>> The secure channel is destroyed. >>>> >>>> The server stores the digest and the salt. >>>> >>>> >>>> Password Validation: >>>> >>>> Use DH to setup temporary secure channel between server and a client. >>>> >>>> The client encrypts the password using this session and sends the >>>> ciphertext to the server. >>>> >>>> The server decrypts, looks up your account, hashes the password with >>>> the stored random salt. >>> >>> NO! Do not send the password to the fucking server, hash on the fucking >>> CLIENT and send the fucking HASH to the fucking server.' >> >> Okay. I was thinking of sending an encrypted password using a DH secure >> channel. We can most certainly hash on the client, then send the digest >> to the server using a secure DH? > > When using encrypted protocol it is same. When attacker has hash it is > same as plain text. Exactly. This is why its good to try to setup a temporary secure channel, just to send ciphertext to the server. >> >>> >>> /Flibble >>> >> > >
Back to comp.lang.c++ | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-09 12:54 -0800
Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-27 20:19 -0800
Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-28 16:50 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:34 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:37 -0800
Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-28 16:24 -0800
Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 03:48 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 21:33 -0800
Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 06:28 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 22:34 -0800
Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:51 +0000
Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 07:34 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:40 -0800
Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 14:46 +0100
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-01 12:59 -0800
Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 22:47 +0100
Re: Regal eagle / American cloud red floyd <no.spam@its.invalid> - 2020-03-01 22:14 -0800
Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-03-03 08:06 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:21 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:24 -0800
Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-03 08:11 +0100
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:31 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:33 -0800
exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 08:24 -0800
Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 10:26 -0800
Re: exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 11:00 -0800
Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 13:17 -0800
Re: exception with distinct data members and concatenated what Paavo Helde <myfirstname@osa.pri.ee> - 2020-12-08 22:13 +0200
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:38 -0800
Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:50 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:32 -0800
csiph-web