Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.c++ > #72061

Re: Regal eagle / American cloud

From "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com>
Newsgroups comp.lang.c++
Subject Re: Regal eagle / American cloud
Date 2020-02-28 23:32 -0800
Organization Aioe.org NNTP Server
Message-ID <r3d41u$5i2$1@gioia.aioe.org> (permalink)
References (4 earlier) <4c8bba30-c2db-4f38-8ae5-35c337baadd1@googlegroups.com> <W9l6G.466483$Uz.342441@fx32.am4> <r3ct34$18p9$1@gioia.aioe.org> <fwn6G.54127$_h7.15094@fx13.ams1> <sQn6G.1466759$GFe.1117886@fx12.am4>

Show all headers | View raw

On 2/28/2020 10:50 PM, Melzzzzz wrote:
> On 2020-02-29, Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> wrote:
>> On 29/02/2020 05:33, Chris M. Thomasson wrote:
>>> On 2/28/2020 7:48 PM, Melzzzzz wrote:
>>>> On 2020-02-29, woodbrian77@gmail.com <woodbrian77@gmail.com> wrote:
>>>>> On Friday, February 28, 2020 at 5:37:35 PM UTC-6, Chris M. Thomasson wrote:
>>>>>> On 2/27/2020 8:19 PM, woodbrian77@gmail.com wrote:
>>>>>>> On Sunday, February 9, 2020 at 2:54:28 PM UTC-6, Chris M. Thomasson wrote:
>>>>>>>> On 10/30/2019 9:58 AM, woodbrian77@gmail.com wrote:
>>>>>>>>>                                                       Shalom
>>>>>>>>>
>>>>>>>>> Can you give me some suggestions on how to improve my
>>>>>>>>> repo: https://github.com/Ebenezer-group/onwards
>>>>>>>>> ?
>>>>>>>>>
>>>>>>>>> What do you think of recent changes to this file?
>>>>>>>>> https://github.com/Ebenezer-group/onwards/blob/master/src/cmw/tiers/cmwA.cc
>>>>>>>>>
>>>>>>>>> and a version from the end of September:
>>>>>>>>> https://github.com/Ebenezer-group/onwards/blob/9bc4c2646e7dc6421dfdcd9d1107d544c320a13a/src/cmw/tiers/cmwA.cc
>>>>>>>>>
>>>>>>>>> The number of lines hasn't changed much, but the size of the
>>>>>>>>> event loop, the most complicated part of the program, has been
>>>>>>>>> reduced by switching from TCP to SCTP.  Thanks in advance.
>>>>>>>>
>>>>>>>> Iirc, you require a user to "register" by sending you an email with
>>>>>>>> their password in the clear?
>>>>>>>
>>>>>>> I plan to use Wireguard for encryption so it
>>>>>>> could be done after we have that set up.
>>>>
>>>> sending passwords over mail is highly unsecure. No one does it any more.
>>>>>>
>>>>>> How are you storing those user passwords on your end? I hope your not
>>>>>> storing them in the clear... You can store the HMAC'ed result, keyed
>>>>>> with a salt or some random element. Then instead of comparing passwords
>>>>>> in the clear, you can compare hash digests.
>>>>>
>>>>> OK.  I'm also thinking about this:
>>>>> https://www.reddit.com/r/WireGuard/comments/ewzxk4/no_password_protection_at_all/
>>>>>
>>>>> Perhaps I don't need passwords beyond what Wireguard provides.
>>>> Hm, no password is something like sending public keys?
>>>
>>> Very Simple scheme...
>>>
>>> Password Setup:
>>>
>>> Use DH to setup temporary secure channel between server and a client.
>>>
>>> The client encrypts the password using this session and sends the ciphertext to the server.
>>>
>>> The server decrypts and hashes the password with a random salt.
>>>
>>> The secure channel is destroyed.
>>>
>>> The server stores the digest and the salt.
>>>
>>>
>>> Password Validation:
>>>
>>> Use DH to setup temporary secure channel between server and a client.
>>>
>>> The client encrypts the password using this session and sends the ciphertext to the server.
>>>
>>> The server decrypts, looks up your account, hashes the password with the stored random salt.
>>
>> NO! Do not send the password to the fucking server, hash on the fucking CLIENT and send the fucking HASH to the fucking server.
> 
> Hash or ciphertext? Hash is same as sending it in plain text.

We want a ciphertext to be sent across the wire. We can use async crypto 
to get a shared key, then encrypt using a symmetric cipher.

> 
>>
>> /Flibble
>>
> 
>

Back to comp.lang.c++ | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-09 12:54 -0800
  Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-27 20:19 -0800
    Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-28 16:50 +0000
      Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:34 -0800
    Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:37 -0800
      Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-28 16:24 -0800
        Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 03:48 +0000
          Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 21:33 -0800
            Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 06:28 +0000
              Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 22:34 -0800
                Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:51 +0000
                Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 07:34 +0000
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:40 -0800
                Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 14:46 +0100
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-01 12:59 -0800
                Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 22:47 +0100
                Re: Regal eagle / American cloud red floyd <no.spam@its.invalid> - 2020-03-01 22:14 -0800
                Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-03-03 08:06 -0800
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:21 -0800
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:24 -0800
                Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-03 08:11 +0100
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:31 -0800
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:33 -0800
                exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 08:24 -0800
                Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 10:26 -0800
                Re: exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 11:00 -0800
                Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 13:17 -0800
                Re: exception with distinct data members and concatenated what Paavo Helde <myfirstname@osa.pri.ee> - 2020-12-08 22:13 +0200
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:38 -0800
              Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:50 +0000
                Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:32 -0800

csiph-web