Password Encryption (Alpha Implementation)

[frankbicknell]

Re: Password Encryption (Alpha Implementation)

I had tried this a couple of months ago and was not able to get it to work. Steve mentioned key length, mine was much shorter, maybe if your key is shorter than 256b then alpha pads it. I wonder if this is going to change since this is not supposed to work. I don't want to change things only to have to change back.

[frankbicknell]

Re: Password Encryption (Alpha Implementation)

To be honest this isn't even close to being secure. If your "key" gets found then a hacker could get all your passwords in plain text and if people use them for other things then they are in trouble. There have been many well documented high profile hacks of this. This is why people who really know security only use 1 way hashes, then the hacker would need to have lots of rainbow tables to figure out what the plain text is.

How could someone find your key?
It seems to me that it is locked away in the alpha application far from user interface.
To be able to 'guess' with that long of a key seems almost impossible.

[aburningflame]

Re: Password Encryption (Alpha Implementation)

I had tried this a couple of months ago and was not able to get it to work. Steve mentioned key length, mine was much shorter, maybe if your key is shorter than 256b then alpha pads it. I wonder if this is going to change since this is not supposed to work. I don't want to change things only to have to change back.

This would also be my guess - that short key lengths get padded by Alpha.
Who wants to find the magic number? :) hahahah.

Anyways - thanks for the input guys.

[aburningflame]

Re: Password Encryption (Alpha Implementation)

How could someone find your key?
It seems to me that it is locked away in the alpha application far from user interface.
To be able to 'guess' with that long of a key seems almost impossible.

My guess is that the key is stored in some sort of config file - but it encrypted. Or in some folder outside the webroot.
Keys can be gained access too, and usually this is half the battle.
Encrypting is one half, protecting the key is the other.

[jdrake]

Re: Password Encryption (Alpha Implementation)

How could someone find your key?
It seems to me that it is locked away in the alpha application far from user interface.
To be able to 'guess' with that long of a key seems almost impossible.

My problem with this is that it is using reversible encryption, this is a big no-no for storing passwords in this manner in today's world. It really isn't locked away, anyone with a dev copy of alpha on your network can see it w/ no problem.

[aburningflame]

Re: Password Encryption (Alpha Implementation)

My problem with this is that it is using reversible encryption, this is a big no-no for storing passwords in this manner in today's world. It really isn't locked away, anyone with a dev copy of alpha on your network can see it w/ no problem.

Completely disagree. Encryption (which by definition is reversible [vs hashing]) is used all over the world.
HTTPS packets are encrypted/decrypted.

Thats like saying 'locks on doors are a big no no', when you need to get in/out of the house, you use your key. Just because a thief can break into your house, does not mean that locks are a big no no. Thats like saying 'locks are a big no no because any thief with your key can get into your house'...ya well, protect your key.

Anyhow - just my 2 cents.

[jdrake]

Re: Password Encryption (Alpha Implementation)

Completely disagree. Encryption (which by definition is reversible [vs hashing]) is used all over the world.
HTTPS packets are encrypted/decrypted.

Thats like saying 'locks on doors are a big no no', when you need to get in/out of the house, you use your key. Just because a thief can break into your house, does not mean that locks are a big no no. Thats like saying 'locks are a big no no because any thief with your key can get into your house'...ya well, protect your key.

Anyhow - just my 2 cents.

HTTPS is completely different than storing a password in a database. HTTPS has to be decrypted for the server and user to talk to each other. There is no reason why a password has to be decrypted. You don't have to believe me but this is de facto information security standard that I learned in information security 101 back in college.

I searched google and this is is the first site that came up, with millions of other security sites also saying the same thing.

http://www.jasypt.org/howtoencryptuserpasswords.html

So, we have to encrypt passwords, but... how? Here comes our first rule:

I. Encrypt passwords using one-way techniques, this is, digests.

This is because, except for some specific scenarios (mainly regarding legacy integration), there is absolutely no reason for a password being decrypted. If you encrypt your passwords using password-based encryption (a two-way technique) and an attacker gets to know your encryption password, all of your user passwords will be revealed (and, probably, all at a time). If you don't have such encryption password (or key) to be able to decrypt, this risk disappears, and the attacker will have to trust on brute force or similar strategies.

[frankbicknell]

Re: Password Encryption (Alpha Implementation)

My problem with this is that it is using reversible encryption, this is a big no-no for storing passwords in this manner in today's world. It really isn't locked away, anyone with a dev copy of alpha on your network can see it w/ no problem.

Maybe an additional feature from alpha would be to password protect the key.

Scott thanks for pointing that out about the house locks, I was thinking about filling all the key holes with epoxy, then let them try to break in.......

[aburningflame]

Re: Password Encryption (Alpha Implementation)

HTTPS is completely different than storing a password in a database. HTTPS has to be decrypted for the server and user to talk to each other. There is no reason why a password has to be decrypted. You don't have to believe me but this is de facto information security standard that I learned in information security 101 back in college.

I searched google and this is is the first site that came up, with millions of other security sites also saying the same thing.

http://www.jasypt.org/howtoencryptuserpasswords.html

I completely agree with you jdrake.

"There is no reason why a password has to be decrypted" - the above was assuming there was a case that required the password to be decrypted.

If you do not need to ever see the original password - use a 1way hashing algorithm with a salt (although MD5 has been known to be cracked)
http://news.slashdot.org/story/04/08...Rumored-Broken

But say you are encrypting something like a SIN number - or anything else you need to be reversible - the above applies.


Anyways - regardless, at least a function to 1way hash the password IS required for us developers.
Something like this

dim ranpass_hashed as C=alpha_please_encrypt_this_i_need_this_functionality(generated_random_pass,my_key)

I dont care about the decrypt function.

[aburningflame]

Re: Password Encryption (Alpha Implementation)

From your article:
This is because, except for some specific scenarios (mainly regarding legacy integration), there is absolutely no reason for a password being decrypted

[frankbicknell]

Re: Password Encryption (Alpha Implementation)

Thanks for the discussion and the lesson in security. I was completely wrong in my understanding of the purpose of the password. I agree now that there is no need to decrypt a password.
I am still confused about how the encryption process works when you have your security tables active linked to sql tables. How can I use the sql security tables with password encryption enabled? I was told that the methods previously discussed will no longer work in V11.

[aburningflame]

Re: Password Encryption (Alpha Implementation)

Thanks for the discussion and the lesson in security. I was completely wrong in my understanding of the purpose of the password. I agree now that there is no need to decrypt a password.
I am still confused about how the encryption process works when you have your security tables active linked to sql tables. How can I use the sql security tables with password encryption enabled? I was told that the methods previously discussed will no longer work in V11.

I use the a5_save_web_user_values ..and alpha will internally encrypt for me.
The other option is to just use your own security and own security restrictions (which kind of makes the grid security groups etc etc useless)

[frankbicknell]

Re: Password Encryption (Alpha Implementation)

Thanks Scott,

Any idea of where I can find the help on that? I searched the local, online, and wiki help files and got no hits.

[Steve Wood]

Re: Password Encryption (Alpha Implementation)

We can be sure that Alpha's intention is that the password cannot be decrypted or even accessed outside of what is built in. Far as I know the only place to recover the password is the "Lost Password" link on the Login dialog. There are no other functions that retrieve the password. For sure, the password BELONGS to the user, not the developer or the owner of the application. That, I am sure is the reasoning behind why the password is not available even to the Developer.

[aburningflame]

Re: Password Encryption (Alpha Implementation)

We can be sure that Alpha's intention is that the password cannot be decrypted or even accessed outside of what is built in. Far as I know the only place to recover the password is the "Lost Password" link on the Login dialog. There are no other functions that retrieve the password. For sure, the password BELONGS to the user, not the developer or the owner of the application. That, I am sure is the reasoning behind why the password is not available even to the Developer.

Fair enough - but then what is their reason to not provide a 1way encryption function?
If I, as a developer, want to insert a user with a random password - I have to use the save_web_user_values. This save_web_user_values, encrypts the plaintext password I sent it.
All i was asking for was the smaller chunk of save_web_user that actually does the encryption.
I dont care about inner workings, or decryption Just.

dim pass as C=substr(remspecial(api_uuidcreate()),1,8)
pass=a5ws_encrypt_password(pass)

But I guess they dont want to provide it.