Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.c++ > #72064
| From | "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> |
|---|---|
| Newsgroups | comp.lang.c++ |
| Subject | Re: Regal eagle / American cloud |
| Date | 2020-02-28 23:40 -0800 |
| Organization | Aioe.org NNTP Server |
| Message-ID | <r3d4ho$816$2@gioia.aioe.org> (permalink) |
| References | (6 earlier) <r3ct34$18p9$1@gioia.aioe.org> <fwn6G.54127$_h7.15094@fx13.ams1> <r3d0kv$1nc1$1@gioia.aioe.org> <DRn6G.1466760$GFe.1466664@fx12.am4> <_to6G.60660$4z5.47573@fx30.ams1> |
On 2/28/2020 11:34 PM, Mr Flibble wrote: > On 29/02/2020 06:51, Melzzzzz wrote: >> On 2020-02-29, Chris M. Thomasson <chris.m.thomasson.1@gmail.com> wrote: >>> On 2/28/2020 10:28 PM, Mr Flibble wrote: >>>> On 29/02/2020 05:33, Chris M. Thomasson wrote: >>>>> On 2/28/2020 7:48 PM, Melzzzzz wrote: >>>>>> On 2020-02-29, woodbrian77@gmail.com <woodbrian77@gmail.com> wrote: >>>>>>> On Friday, February 28, 2020 at 5:37:35 PM UTC-6, Chris M. Thomasson >>>>>>> wrote: >>>>>>>> On 2/27/2020 8:19 PM, woodbrian77@gmail.com wrote: >>>>>>>>> On Sunday, February 9, 2020 at 2:54:28 PM UTC-6, Chris M. >>>>>>>>> Thomasson wrote: >>>>>>>>>> On 10/30/2019 9:58 AM, woodbrian77@gmail.com wrote: >>>>>>>>>>> Shalom >>>>>>>>>>> >>>>>>>>>>> Can you give me some suggestions on how to improve my >>>>>>>>>>> repo: https://github.com/Ebenezer-group/onwards >>>>>>>>>>> ? >>>>>>>>>>> >>>>>>>>>>> What do you think of recent changes to this file? >>>>>>>>>>> https://github.com/Ebenezer-group/onwards/blob/master/src/cmw/tiers/cmwA.cc >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> and a version from the end of September: >>>>>>>>>>> https://github.com/Ebenezer-group/onwards/blob/9bc4c2646e7dc6421dfdcd9d1107d544c320a13a/src/cmw/tiers/cmwA.cc >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> The number of lines hasn't changed much, but the size of the >>>>>>>>>>> event loop, the most complicated part of the program, has been >>>>>>>>>>> reduced by switching from TCP to SCTP. Thanks in advance. >>>>>>>>>> >>>>>>>>>> Iirc, you require a user to "register" by sending you an email >>>>>>>>>> with >>>>>>>>>> their password in the clear? >>>>>>>>> >>>>>>>>> I plan to use Wireguard for encryption so it >>>>>>>>> could be done after we have that set up. >>>>>> >>>>>> sending passwords over mail is highly unsecure. No one does it any >>>>>> more. >>>>>>>> >>>>>>>> How are you storing those user passwords on your end? I hope >>>>>>>> your not >>>>>>>> storing them in the clear... You can store the HMAC'ed result, >>>>>>>> keyed >>>>>>>> with a salt or some random element. Then instead of comparing >>>>>>>> passwords >>>>>>>> in the clear, you can compare hash digests. >>>>>>> >>>>>>> OK. I'm also thinking about this: >>>>>>> https://www.reddit.com/r/WireGuard/comments/ewzxk4/no_password_protection_at_all/ >>>>>>> >>>>>>> >>>>>>> >>>>>>> Perhaps I don't need passwords beyond what Wireguard provides. >>>>>> Hm, no password is something like sending public keys? >>>>> >>>>> Very Simple scheme... >>>>> >>>>> Password Setup: >>>>> >>>>> Use DH to setup temporary secure channel between server and a client. >>>>> >>>>> The client encrypts the password using this session and sends the >>>>> ciphertext to the server. >>>>> >>>>> The server decrypts and hashes the password with a random salt. >>>>> >>>>> The secure channel is destroyed. >>>>> >>>>> The server stores the digest and the salt. >>>>> >>>>> >>>>> Password Validation: >>>>> >>>>> Use DH to setup temporary secure channel between server and a client. >>>>> >>>>> The client encrypts the password using this session and sends the >>>>> ciphertext to the server. >>>>> >>>>> The server decrypts, looks up your account, hashes the password with >>>>> the stored random salt. >>>> >>>> NO! Do not send the password to the fucking server, hash on the fucking >>>> CLIENT and send the fucking HASH to the fucking server.' >>> >>> Okay. I was thinking of sending an encrypted password using a DH secure >>> channel. We can most certainly hash on the client, then send the digest >>> to the server using a secure DH? >> >> When using encrypted protocol it is same. When attacker has hash it is >> same as plain text. > > You are missing the point: people use the same password for different > things: if the hash is compromised it only compromises access to this > particular server; also > you cannot gaurantee that lemons working on the server code don't log it > by mistake. NEVER send password in the clear from the CLIENT computer > even over encrpypted links. It must use encrpypted links regardless. > Clue: you can hash a hash. > > /Flibble >
Back to comp.lang.c++ | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-09 12:54 -0800
Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-27 20:19 -0800
Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-28 16:50 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:34 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 15:37 -0800
Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-02-28 16:24 -0800
Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 03:48 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 21:33 -0800
Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 06:28 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 22:34 -0800
Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:51 +0000
Re: Regal eagle / American cloud Mr Flibble <flibbleREMOVETHISBIT@i42.co.uk> - 2020-02-29 07:34 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:40 -0800
Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 14:46 +0100
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-01 12:59 -0800
Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-01 22:47 +0100
Re: Regal eagle / American cloud red floyd <no.spam@its.invalid> - 2020-03-01 22:14 -0800
Re: Regal eagle / American cloud woodbrian77@gmail.com - 2020-03-03 08:06 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:21 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-02 13:24 -0800
Re: Regal eagle / American cloud David Brown <david.brown@hesbynett.no> - 2020-03-03 08:11 +0100
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:31 -0800
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-03-03 01:33 -0800
exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 08:24 -0800
Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 10:26 -0800
Re: exception with distinct data members and concatenated what "daniel...@gmail.com" <danielaparker@gmail.com> - 2020-12-08 11:00 -0800
Re: exception with distinct data members and concatenated what Öö Tiib <ootiib@hot.ee> - 2020-12-08 13:17 -0800
Re: exception with distinct data members and concatenated what Paavo Helde <myfirstname@osa.pri.ee> - 2020-12-08 22:13 +0200
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:38 -0800
Re: Regal eagle / American cloud Melzzzzz <Melzzzzz@zzzzz.com> - 2020-02-29 06:50 +0000
Re: Regal eagle / American cloud "Chris M. Thomasson" <chris.m.thomasson.1@gmail.com> - 2020-02-28 23:32 -0800
csiph-web