Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Euler Humble Return

projecteuler.net

Post reply on HN
Print view View original

61–70 of 127 posts

Re: Project Euler Humble Return

#61

Post by mindcrime »

OK, well, here's an initial observation:

1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually has some administrative access... that's a bad idea. "Security through obscurity" is oft derided, but no sense making it easy for the bad guys. Make your admin username "flummoxedrabbit" or something that nobody bothers trying. As it is, I'm hoping this "admin" account is a dummy or a honeypot or something, but if it isn't, I definitely encourage you to change that and quit leaking username validity information.

2. From the limited testing I did, it doesn't appear that you limit the number of failed login attempts. Or if you do, the login limit is awfully high. I tried logging in 10 times and as far as I can tell, I could have kept going. If there really is no limit, it's probably not that hard to brute force your password. There are plenty of scripts and browser plugins to sit there and try to login repeatedly, trying to brute force forms like that.

3. In addition to limiting the number of login attempts, it's possibly a good idea to add a steadily increasing delay before accepting another login try from the same IP address, after each failed login. This will slow down at least some attempts to brute force your password.

4. You could consider some sort of Multi-Factor Authentication setup.

5. You could also consider adding code to do something similar to what fail2ban does, and automatically block connections from an IP where more than X failed logins originate in some period of time.

Re: Project Euler Humble Return

#62

Post by function_seven »

mindcrime wrote: post #61

OK, well, here's an initial observation: 1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually…

Regarding #1, telling the user that their login failed doesn't eliminate their ability to enumerate existing usernames. All they have to do instead is attempt to register a new account with the username they're testing. At some point, the site will have to tell them that the username already exists.

#2-#5 are all good points, though, and would help prevent username enumeration as well.

Re: Project Euler Humble Return

#63

Post by tedunangst »

mindcrime wrote: post #61

OK, well, here's an initial observation: 1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually…

There's also an account named "backdoor".

Re: Project Euler Humble Return

#64

Post by mindcrime »

function_seven wrote: post #62
mindcrime wrote: post #61

OK, well, here's an initial observation: 1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually…

Regarding #1, telling the user that their login failed doesn't eliminate their ability to enumerate existing usernames. All they have to do instead is attempt to register a new account with the username they're testing. At some point, the site will have to tell them that the username already exists. #2-#5 are all good points, though, and would help prevent username enumeration as well.

Regarding #1, telling the user that their login failed doesn't eliminate their ability to enumerate existing usernames. All they have to do instead is attempt to register a new account with the username they're testing. At some point, the site will have to tell them that the username already exists.

Agreed, but I would lean towards giving the bad guys as few tools as possible. If you require a captcha to register, and if you limit the number of registration attempts, you can also cut down on that channel.

That's not to say that this stuff is the be all / end all of course. It would probably be better to eliminate username/password combos altogether and do everything with keypairs, but until that day comes...

Re: Project Euler Humble Return

#65

Post by [deleted] »

ProjectEuler wrote: post #48
krapp wrote: post #40

Earlier quoted context omitted.

Probably. If they're not using PDO then that needs to be their first priority, dead stop. After that, maybe looking at their captcha script, because those sometimes have issues if they're not well designed. I don't know where theirs comes from but it doesn't seem to use much obfuscation so it's probably old. After that, Twig. Although judging by a screenshot of the recent hack[0] posted here[1] escaping (and XSS) may…

Admin from PE here. We've already been using PDO. As for overall privacy/security, please see https://projecteuler.net/privacy

[deleted]

Re: Project Euler Humble Return

#66

Post by mindcrime »

mindcrime wrote: post #61

OK, well, here's an initial observation: 1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually…

Another area I'd suggest looking into is your "recover your account key" setup. If the keys really really are random, then this is probably fine. But if there's any flaw resulting in your generated keys being less than ideally random, somebody could have figured out a way to generate an account recovery key, and then used that to steal an administrative account. That is, assuming your administrative user even has that option. If it does, it might be a good idea to disable that, since you presumably have direct db access anyway, and can always backdoor your way in if you forget your own password.

Re: Project Euler Humble Return

#68

Post by mindcrime »

tedunangst wrote: post #63
mindcrime wrote: post #61

OK, well, here's an initial observation: 1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually…

There's also an account named "backdoor".

And "root" as well, apparently.

Re: Project Euler Humble Return

#69

Post by teach »

ghshephard wrote: post #59
lukev wrote: post #38

Earlier quoted context omitted.

Except that as long as you use a unique password, and don't give any details that you don't mind falling into the wrong hands, there is absolutely no risk . Unlike, for example, actual mines.

There is a lot of risk going to a compromised website. You are basically inputting potential malware onto your computer, and, if there are zero-days present on your system, handing control of your computer over to a malware author.

Yes, I'm pretty worried about browsing a website with no ads using Chrome on my Linux machine with uBlock origin and Flash disabled.

I think I take greater risks going for a walk in the evening.

Re: Project Euler Humble Return

#70

Post by krapp »

mindcrime wrote: post #66
mindcrime wrote: post #61

OK, well, here's an initial observation: 1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually…

Another area I'd suggest looking into is your "recover your account key" setup. If the keys really really are random, then this is probably fine. But if there's any flaw resulting in your generated keys being less than ideally random, somebody could have figured out a way to generate an account recovery key, and then used that to steal an administrative account. That is, assuming your administrative user even has tha…

There are times when I lie in bed at night and stare into the shadows and think to myself web based administration is probably always a bad idea.

Unfortunately, the alternatives are unthinkable for everyone who isn't a programmer.

Post reply on HN