Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Euler Humble Return

projecteuler.net

Post reply on HN
Print view View original

91–100 of 127 posts

Re: Project Euler Humble Return

#91

Post by giancarlostoro »

mmanfrin wrote: post #54
dyoo1979 wrote: post #35

It would be nice if source were provided, so that we can do a whitebox analysis. I don't have confidence that there is one single point of failure here, given that the site has already been compromised multiple times.

Especially since PE is such a technically simple site. It's login/logout, listing of problems, and confirmation/logging of problem success. It's simpler than the apps that beginning web framework tutorials show how to make.

We see lots of projects on HN that get open sourced. It's surprising nobody has made one yet. I've even seen clones to HackerNews open sourced here.

Re: Project Euler Humble Return

#92

Post by colechristensen »

daguava wrote: post #81
mhink wrote: post #80

Earlier quoted context omitted.

So basically, by telling us this, you're completely contravening the request they made that security vulnerabilities be disclosed privately? Kind of a jerk move.

While I am kind of a jerk, I haven't made a vulnerability of it yet, just an info leak that may help someone here complete the puzzle.

If this was an essential security library instead of a fun website, this would have been an incredibly irresponsible disclosures.

Bug bounty programs searching for security vulnerabilities rarely need completed proof of concept exploits – crashes are enough. You've laid down all of the pieces for someone competent to potentially do some real damage without much work at all, and that's exactly why the request was made not to disclose any further vulnerabilities.

Re: Project Euler Humble Return

#94

Post by rnovak »

daguava wrote: post #81
mhink wrote: post #80

Earlier quoted context omitted.

So basically, by telling us this, you're completely contravening the request they made that security vulnerabilities be disclosed privately? Kind of a jerk move.

While I am kind of a jerk, I haven't made a vulnerability of it yet, just an info leak that may help someone here complete the puzzle.

I think you're confusing "exploit" and vulnerability. An info leak is a vulnerability. Period.

And yes. You completely went around their request, and made this info public without their consent.

Actions like this are THE reason the relationship between vendors and security researchers is strained.

There's a SPECIFIC reason it's considered common courtesy to wait until a vulnerability is patched before public disclosure.

IANAL, but you also violated their ToS by doing this, and if you did this to a site I owned, especially without my consent, I'd be very motivated to contact the proper authorities and pursue civil remedies.

Re: Project Euler Humble Return

#95

Post by tsukikage »

aikah wrote: post #83

Open source that site. Vet a few devs to have access to the source to begin with then opensource it. Or even better, let the community rewrite the source from scratch. How hard can it be? and there are often a lot of people willing to contribute to open-source projects.

"How hard can it be?" <--- yeah, that's how you end up with vulnerable sites.

Re: Project Euler Humble Return

#96

Post by GlennS »

rev_bird wrote: post #82
0942v8653 wrote: post #25

Earlier quoted context omitted.

On the other hand, you might not want to be hashing a 20meg password. It is fast on my computer but it's fair to limit at something more reasonable. $ python -c 'print "8 bytes\n" * (20 * 1024 * 1024 / 8)' > 20meg.txt; time shasum -a 512 20meg.txt 59cb7f88ad8d6229e6d3a74ee422dff57e17f168c6e6fa44ef32c3f07a73a6e455d8b55c1265d5212b9ed5475b6d9364286645200dada59aa16905a9ce748561 20meg.txt real 0m0.289s user 0m0.284s sys 0…

I'm admittedly not familiar with the details of the hashing process, but it could be done client-side, no? Then the compute power required falls on the user, PLUS the 20 megs never gets sent over the wire.

If you do the hashing on the client side, then the hash itself effectively becomes the password.

Re: Project Euler Humble Return

#97

Post by ColinWright »

Retra wrote: post #87
rev_bird wrote: post #82

Earlier quoted context omitted.

I'm admittedly not familiar with the details of the hashing process, but it could be done client-side, no? Then the compute power required falls on the user, PLUS the 20 megs never gets sent over the wire.

If you're not sending 20 megs of data, you're not getting 20 megs of security. So why allow it if it doesn't add anything?

It doesn't add to the security, but I might find it easier to remember 20 MB of redundant and meaningful stuff than to remember 384 bits of literally random stuff. The entropy might be the same, but my memory is not a computer. I can remember vast amounts of material that is meaningful and use it as a password. I can't remember 384 bits that have no meaning.

The benefit isn't in the entropy, it's in the abilities of your users to remember their passwords/passphrases in the first place.

Re: Project Euler Humble Return

#98

Post by ColinWright »

mkagenius wrote: post #88
rev_bird wrote: post #82

Earlier quoted context omitted.

I'm admittedly not familiar with the details of the hashing process, but it could be done client-side, no? Then the compute power required falls on the user, PLUS the 20 megs never gets sent over the wire.

No. Actually we would not want the hashing technique to be exposed in the source code.

That turns out not to be the whole story.

Hiding the technique to compute the hash is relying on security by obscurity. Ideally you want a system that is secure even if potential attackers know what methods you're using.

Re: Project Euler Humble Return

#99

Post by ColinWright »

a_t48 wrote: post #21
gherkin0 wrote: post #19

Earlier quoted context omitted.

> 256 characters makes for a fairly sizable passphrase, and doesn't represent a substantial hit on storage space. They shouldn't be storing passwords at all so storage space should be a non-issue. My 20 meg password should hash down to the same small(er) value as your 15 character one.

When there will be multiple shorter passwords that hash to the same value, is there a point to a 20mb pass?

Yes. Ideally you want users to be able to remember their pass-phrases. To do so usually implies significant internal structure and/or correlations, so to get the necessary entropy they will be large. The fact that they hash to the same value as other things is effectively irrelevant.

Re: Project Euler Humble Return

#100

Post by Houshalter »

I am unable to login to my account, so I'm not able to test this. But if I remember correctly this site used a poor captcha. There has been a lot of advancement at captcha breaking software in recent years. If they used some kind of custom captcha to prevent password guessing, then it's not extremely secure.
Post reply on HN