Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Euler Humble Return

projecteuler.net

Post reply on HN
Print view View original

81–90 of 127 posts

Re: Project Euler Humble Return

#81

Post by daguava »

mhink wrote: post #80
daguava wrote: post #74

You can list what problems you've solved by showing an image generated for you. Ex) https://projecteuler.net/profile/daguava.png But you can also use this to quickly test the status of accounts. For example, I was able to find Euler is an admin account by trying https://projecteuler.net/profile/euler.png It tells you it's admin in the image, why? Edit: Wonder if they're exposing some vulnerability with the HTTP 300 M…

So basically, by telling us this, you're completely contravening the request they made that security vulnerabilities be disclosed privately? Kind of a jerk move.

While I am kind of a jerk, I haven't made a vulnerability of it yet, just an info leak that may help someone here complete the puzzle.

Re: Project Euler Humble Return

#82

Post by rev_bird »

0942v8653 wrote: post #25
gherkin0 wrote: post #19

Earlier quoted context omitted.

> 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. They shouldn't be storing passwords at all so storage space should be a non-issue. My 20 meg password should hash down to the same small(er) value as your 15 character one.

On the other hand, you might not want to be hashing a 20meg password. It is fast on my computer but it's fair to limit at something more reasonable. $ python -c 'print "8 bytes\n" * (20 * 1024 * 1024 / 8)' > 20meg.txt; time shasum -a 512 20meg.txt 59cb7f88ad8d6229e6d3a74ee422dff57e17f168c6e6fa44ef32c3f07a73a6e455d8b55c1265d5212b9ed5475b6d9364286645200dada59aa16905a9ce748561 20meg.txt real 0m0.289s user 0m0.284s sys 0…

I'm admittedly not familiar with the details of the hashing process, but it could be done client-side, no? Then the compute power required falls on the user, PLUS the 20 megs never gets sent over the wire.

Re: Project Euler Humble Return

#83

Post by aikah »

Open source that site. Vet a few devs to have access to the source to begin with then opensource it. Or even better, let the community rewrite the source from scratch. How hard can it be? and there are often a lot of people willing to contribute to open-source projects.

Re: Project Euler Humble Return

#84

Post by trengrj »

Part of me learning to code was by going through the challenges on Project Euler and I always get a sense of nostalgia when reading about it.

It is a pity it keeps getting hacked. I think that the site owners are more interested in algorithms and mathematics than mundane engineering. It would probably be a good idea to open source the site.

Re: Project Euler Humble Return

#85

Post by stevenjohns »

kjs3 wrote: post #52
jimmaswell wrote: post #47

Earlier quoted context omitted.

to serve malware

Sigh...so true. Sad to say, I miss the days when folks did this sort of shit just because they're asshole sociopaths.

Right! A couple of years ago some (self-reported) Turkish hackers exploited a Wordpress vuln and took control of my hosting. All they did was change index.php into their own landing page telling everyone that I got owned, that Turkey is the best, and (from memory) an Islamic Nasheed playing in the background.

It took me a couple of minutes to get everything fixed, but I can only imagine what would have happened if they were more malicious and used it to serve malware or as part of a botnet attacking other sites.

It was still annoying, disruptive and unwanted, but it was so much easier to deal with than some more malicious hacks out there.

Re: Project Euler Humble Return

#86

Post by mindcrime »

dongkyun wrote: post #78
mindcrime wrote: post #61

OK, well, here's an initial observation: 1. Your login page leaks information, as it returns "username not found" if you enter an invalid username. This is a bad idea. Better to simply say "login failed" in any case. Now, thanks to a few minutes of playing around, I have a fairly good idea that "admin" is a valid username on projecteuler.net. For the sake of argument, let's assume that's a real account, and actually…

Using what Daguva mentioned above, it looks like admin ( https://projecteuler.net/profile/admin.png ) is just a regular accounts, compared to say, euler ( https://projecteuler.net/profile/euler.png )

Yep, which makes his discovery much more damaging. That was a good find, and something PE should definitely fix!

Re: Project Euler Humble Return

#87

Post by Retra »

rev_bird wrote: post #82
0942v8653 wrote: post #25

Earlier quoted context omitted.

On the other hand, you might not want to be hashing a 20meg password. It is fast on my computer but it's fair to limit at something more reasonable. $ python -c 'print "8 bytes\n" * (20 * 1024 * 1024 / 8)' > 20meg.txt; time shasum -a 512 20meg.txt 59cb7f88ad8d6229e6d3a74ee422dff57e17f168c6e6fa44ef32c3f07a73a6e455d8b55c1265d5212b9ed5475b6d9364286645200dada59aa16905a9ce748561 20meg.txt real 0m0.289s user 0m0.284s sys 0…

I'm admittedly not familiar with the details of the hashing process, but it could be done client-side, no? Then the compute power required falls on the user, PLUS the 20 megs never gets sent over the wire.

If you're not sending 20 megs of data, you're not getting 20 megs of security. So why allow it if it doesn't add anything?

Re: Project Euler Humble Return

#88

Post by mkagenius »

rev_bird wrote: post #82
0942v8653 wrote: post #25

Earlier quoted context omitted.

On the other hand, you might not want to be hashing a 20meg password. It is fast on my computer but it's fair to limit at something more reasonable. $ python -c 'print "8 bytes\n" * (20 * 1024 * 1024 / 8)' > 20meg.txt; time shasum -a 512 20meg.txt 59cb7f88ad8d6229e6d3a74ee422dff57e17f168c6e6fa44ef32c3f07a73a6e455d8b55c1265d5212b9ed5475b6d9364286645200dada59aa16905a9ce748561 20meg.txt real 0m0.289s user 0m0.284s sys 0…

I'm admittedly not familiar with the details of the hashing process, but it could be done client-side, no? Then the compute power required falls on the user, PLUS the 20 megs never gets sent over the wire.

No. Actually we would not want the hashing technique to be exposed in the source code.

Re: Project Euler Humble Return

#89

Post by roblabla »

rev_bird wrote: post #82
0942v8653 wrote: post #25

Earlier quoted context omitted.

On the other hand, you might not want to be hashing a 20meg password. It is fast on my computer but it's fair to limit at something more reasonable. $ python -c 'print "8 bytes\n" * (20 * 1024 * 1024 / 8)' > 20meg.txt; time shasum -a 512 20meg.txt 59cb7f88ad8d6229e6d3a74ee422dff57e17f168c6e6fa44ef32c3f07a73a6e455d8b55c1265d5212b9ed5475b6d9364286645200dada59aa16905a9ce748561 20meg.txt real 0m0.289s user 0m0.284s sys 0…

I'm admittedly not familiar with the details of the hashing process, but it could be done client-side, no? Then the compute power required falls on the user, PLUS the 20 megs never gets sent over the wire.

That would assume your users have JS enabled. I've seen something like that done before, but always with a fallback in case user has JS disabled.

Re: Project Euler Humble Return

#90

Post by lcswi »

stevenjohns wrote: post #85
kjs3 wrote: post #52

Earlier quoted context omitted.

Sigh...so true. Sad to say, I miss the days when folks did this sort of shit just because they're asshole sociopaths.

Right! A couple of years ago some (self-reported) Turkish hackers exploited a Wordpress vuln and took control of my hosting. All they did was change index.php into their own landing page telling everyone that I got owned, that Turkey is the best, and (from memory) an Islamic Nasheed playing in the background. It took me a couple of minutes to get everything fixed, but I can only imagine what would have happened if th…

How do you know the defacement was not just a distraction of the NSA adding your machine to their bot net with some privilege escalation and root kit? Sorry :-)
Post reply on HN