Password Security Under Alpha Five

[waldhorn]

In reading today's New York Times article on the weakness of LinkedIn's password security model--exposed for all the world to see after their recent data breach--as a new Alpha Five user, I have begun to wonder: How secure are passwords stored under Alpha Five?

For instance, a couple of question come to mind:

• What is Alpha Five's password encryption method?
• Are passwords salted?

Regarding salting, according to the NYT article:

Salting passwords, security experts say, is Security 101 — a basic step that LinkedIn, eHarmony and Lastfm.com all failed to take. (An A+ security grade involves hashing passwords with complex cryptographic functions, salting them, hashing the result again and storing those credentials on separate, secure Web servers where hackers cannot easily break in.)

How far does Alpha Five go? How far should they go?

[bea2701]

Re: Password Security Under Alpha Five

read howto setup security in the wiki manifest it's more clear, my advice in the setting activate encryption for passwords set the length to min. 6 . put the security tables in a sql db. use a database firewall.

[waldhorn]

Re: Password Security Under Alpha Five

read howto setup security in the wiki manifest

The Alpha wiki article that you are referring to, Set Security Properties, describes how to set up web security. However, it does doesn't go into detail about (1) Alpha's encryption methods and (2) whether they salt passwords.

Eventually, someone's Alpha Five application will be breached and their user's password hashes may be made public, as in the case of LinkedIn. As outlined in the NYT article above, understanding Alpha Five's security methods is necessary to showing that your user's password hashes are reasonably secure against a dictionary attack, should they become public.

[Steve Wood]

Re: Password Security Under Alpha Five

...understanding Alpha Five's security methods is necessary to showing that your user's password hashes are reasonably secure against a dictionary attack, should they become public.

Wouldn't everyone "understanding" Alpha's encryption model make it easier for would-be hacker to hack the passwords?

The passwords are encrypted with two "salts", the one you provide in the web security configuration, and the one that Alpha appends to the one you provide.

[waldhorn]

Re: Password Security Under Alpha Five

Wouldn't everyone "understanding" Alpha's encryption model make it easier for would-be hacker to hack the passwords?

That's a variant of "security through obscurity" which is well-discussed and has its proponents and detractors. For myself, when it comes to evaluating the security of a web application, I'm looking for more information rather than simply trusting the designer to have made good decisions.

The passwords are encrypted with two "salts", the one you provide in the web security configuration, and the one that Alpha appends to the one you provide.

Can you point me to that information in the documentation?

[Steve Wood]

Re: Password Security Under Alpha Five

You will have to call the company directly, I know from experience they won't discuss it here; and nothing is written in the docs about it.

[The Mage]

Re: Password Security Under Alpha Five

The best security system in the world doesn't matter if your password is poor, or easy to figure out. It is unfortunate that one of the most common passwords is "password".

But most of the higher profile stories you hear about hacking, actually weren't done by computer. At least not entirely. The best hackers will contact businesses, and pose as employees, or customers, or even government officials attempting to get some information, or cause them to allow access. There are even hackers who have brazenly walked into an office, found a computer that was unattended, but logged in, and set themselves up an account.

Alpha recently did have a blog post about building HIPAA applications, and mentioned their security a little bit, though not the specifics you mention. Though it looks like it is better to use a(n) SQL backend instead of their native dbf.

http://blog.alphasoftware.com/2012/0...ions-with.html

Doesn't specifically mention password security, but it does mention the security being set for each grid, and for every ajax callback.

I do know they have mentioned Alpha apparently won't allow SQL injection attacks, and every global variable is now protected. From everything I have seen, they seem to have a good focus on security. But you still need to do things right on your end.

[Peter.Greulich]

Re: Password Security Under Alpha Five

I do know they have mentioned Alpha apparently won't allow SQL injection attacks

IF you use arguments.

[bea2701]

Re: Password Security Under Alpha Five

IF you use arguments.

add a extra layer use a WAF