Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Workaday Wizard
Oct 23, 2009

by Pragmatica
the username hash is impressive.

Adbot
ADBOT LOVES YOU

iospace
Jan 19, 2038



And md5 :stonk:

CPColin
Sep 9, 2003

Big ol' smile.
Remember: when storing a hash in your database, always be sure to identify the hashing method in your column name.

Suspicious Dish
Sep 24, 2011

2020 is the year of linux on the desktop, bro
Fun Shoe
the username hash gives away that they were told "hey you know you need to hash your username/passwords" at some point but never quite figured out why

Xarn
Jun 26, 2015
To be fair (:suicide:) it is completely standard to store hashes in selfdescribing format, where the hash includes its salt and the hash method :shrug:

CPColin
Sep 9, 2003

Big ol' smile.
Yeah, you're right. I forgot about that.

Volguus
Mar 3, 2009

Xarn posted:

To be fair (:suicide:) it is completely standard to store hashes in selfdescribing format, where the hash includes its salt and the hash method :shrug:

To be even fairer, even secure hash methods can be spotted quite fast. Bcrypt itself has "magic chars" at the start: $2b$ for 2014 protocol, $2a$ original, etc. And some versions even had a broken crypt_blowfish algorithm. If you live in 1999, knowing that a hash is MD5 does't help you much.

Absurd Alhazred
Mar 27, 2010

by Athanatos
You're also not supposed to secure through obscurity. The main problem is keeping them in plaintext, not that an attacker will know what hash function you use.

Plorkyeran
Mar 22, 2007

To Escape The Shackles Of The Old Forums, We Must Reject The Tribal Negativity He Endorsed

Volguus posted:

To be even fairer, even secure hash methods can be spotted quite fast. Bcrypt itself has "magic chars" at the start: $2b$ for 2014 protocol, $2a$ original, etc. And some versions even had a broken crypt_blowfish algorithm. If you live in 1999, knowing that a hash is MD5 does't help you much.

It's also just a pretty safe assumption that when you see a 32 character hex string it's a md5 hash.

Hammerite
Mar 9, 2007

And you don't remember what I said here, either, but it was pompous and stupid.
Jade Ear Joe

Absurd Alhazred posted:

You're also not supposed to secure through obscurity. The main problem is keeping them in plaintext, not that an attacker will know what hash function you use.

yeah, merely being told what hash function is used should not help an attacker in any significant way. The protection is supposed to be provided by the resistance to bruteforcing of the function itself, so that it doesn't matter if attacker knows what it is.

The fact that the hash function in use is explicitly disclosed by the database column names is entirely irrelevant. The issues are the unsuitable choice of hash function, and the fact that the plaintext is stored alongside it anyway. Also the fact that a hash of the username is stored, but that only (further) illustrates that the person who designed the system doesn't understand the purpose of hashing things in a password-based system.

DONT THREAD ON ME
Oct 1, 2002

by Nyc_Tattoo
Floss Finder
the best practice is actually to name your field *_md5, but to hash with something secure to throw hackers off the trail.

necrotic
Aug 2, 2005
I owe my brother big time for this!
password_md5 = SUBSTR(SHA256, 32)

LOOK I AM A TURTLE
May 22, 2003

"I'm actually a tortoise."
Grimey Drawer
It would be a pretty solid troll on hopeful hackers to have a column named password_md5 containing MD5 hashes, but the plaintexts are salted bcrypt hashes.

Dr. Stab
Sep 12, 2010
👨🏻‍⚕️🩺🔪🙀😱🙀

LOOK I AM A TURTLE posted:

It would be a pretty solid troll on hopeful hackers to have a column named password_md5 containing MD5 hashes, but the plaintexts are salted bcrypt hashes.

Where would you store the salt?

Munkeymon
Aug 14, 2003

Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.



Dr. Stab posted:

Where would you store the salt?

It's just part of the string that bcrypt emits. You just store it as an opaque string blob.

Or did I miss a joke?

CPColin
Sep 9, 2003

Big ol' smile.

Dr. Stab posted:

Where would you store the salt?

password_pepper

Dylan16807
May 12, 2010

Munkeymon posted:

It's just part of the string that bcrypt emits. You just store it as an opaque string blob.

Or did I miss a joke?

But the suggestion was to only store the md5 of that string. Which won't work unless you hide the salt somewhere else.

Munkeymon
Aug 14, 2003

Motherfucker's got an
armor-piercing crowbar! Rigoddamndicu𝜆ous.



Dylan16807 posted:

But the suggestion was to only store the md5 of that string. Which won't work unless you hide the salt somewhere else.

Oh :doh: right

1337JiveTurkey
Feb 17, 2005

:pseudo: Use the MD5 hash as the salt, then iterate until you hit a fixed point.

LOOK I AM A TURTLE
May 22, 2003

"I'm actually a tortoise."
Grimey Drawer

Dylan16807 posted:

But the suggestion was to only store the md5 of that string. Which won't work unless you hide the salt somewhere else.

My plan has been foiled. Maybe we can start off by cracking the MD5 hashes as part of the login process? But I guess even MD5 isn't bad enough that you can reverse 60 character strings in real time.

iospace
Jan 19, 2038


Dr. Stab posted:

Where would you store the salt?

In the pantry. Next question.

nielsm
Jun 1, 2009



iospace posted:

In the pantry. Next question.

What server specs do you recommend for Pantry? How many nodes do you usually run for applications with 250 concurrent users?

iospace
Jan 19, 2038


nielsm posted:

What server specs do you recommend for Pantry? How many nodes do you usually run for applications with 250 concurrent users?

I'd recommend someone in decent shape, capable of lifting 15-20 pounds at once. Also has to be good with people.. As for 250 concurrent users, at least 7-10.

duz
Jul 11, 2005

Come on Ilhan, lets go bag us a shitpost


Dr. Stab posted:

Where would you store the salt?

In the bluetooth speaker.

Klades
Sep 8, 2011

Put salted bcrypt hashes in the password field, and then md5s of that in the password_md5 field! :eng101:

Here's the latest :whoptc: I'm dealing with:
C++ code:
// In a header file that gets included by basically everything
enum class SomeEnum
{
  ThingOne,
  ThingTwo,
  ThingThree,
  ThingFour,
// etc
  ThingThirty,
};

// ELSEWHERE
class EnumMaps // Oh no
{
public:
  static EnumMaps& instance(); // Pisssssss
  std::map<SomeEnum, size_t>& some_enum_to_index_map(); // Maybe there's a reason for this?
  std::map<size_t, SomeEnum>& index_to_some_enum_map(); // Like the indexes don't match up with the enum values for some reason so this made sense at some point?
private:
  EnumMaps();
  std::map<SomeEnum, size_t> _some_enum_to_index_map {
    { SomeEnum::ThingOne, 0}, // Like maybe there are some gaps in it for legacy reasons and
    // ...
    { SomeEnum::ThingThirty, 29} // gently caress
  }
  std::map<size_t, SomeEnum> _index_to_some_enum_map { // please no
    { 0, SomeEnum::ThingOne }, 
  // ...
    { 29, SomeEnum::ThingThirty}
  }
};
There are several of these map pairs, and the actual code is considerably messier because there are macros everywhere due to the fact that all of this code gets compiled in two places, and one of those places is a poo poo-rear end compiler that doesn't support `enum class`

ChickenWing
Jul 22, 2010

:v:

brap posted:

efficiency: good or bad? The Something Awful goons will get to the bottom of it

https://twitter.com/dril/status/473265809079693312?lang=en

Carbon dioxide
Oct 9, 2012

https://www.youtube.com/watch?v=Q2g9d29UIzk

iospace
Jan 19, 2038


The original Pokemon games are one part coding horror, 10 parts awesome.

Polio Vax Scene
Apr 5, 2009



My client's database has all these characters in it and it's driving me insane.

There's supposed to also be non-breaking spaces in there but I guess the forums are smart enough to correct those!

Polio Vax Scene fucked around with this message at 16:42 on Jul 5, 2018

iospace
Jan 19, 2038


iospace posted:

The original Pokemon games are one part coding horror, 10 parts awesome.

To expand on this because that was a phone post:

Pokemon is probably the only thing held together with more matchsticks and rubber bands than this forum. It's easily exploited via arbitrary code execution, allowing for insane stunts on it. That's the horror.

However, if you play the game normally, you'd never know. They did a lot of interesting and fun tricks to make it work, and for that, it's awesome.

Doom Mathematic
Sep 2, 2008
The original Pokemon games were exactly as well-programmed as they needed to be to become insanely successful and popular. Arguably this is the only possible definition of "good code".

FlapYoJacks
Feb 12, 2009

Doom Mathematic posted:

The original Pokemon games were exactly as well-programmed as they needed to be to become insanely successful and popular. Arguably this is the only possible definition of "good code".

The hardest lesson any programmer or engineer has to learn, is that good code doesn't sell.

darthbob88
Oct 13, 2011

YOSPOS

iospace posted:

To expand on this because that was a phone post:

Pokemon is probably the only thing held together with more matchsticks and rubber bands than this forum. It's easily exploited via arbitrary code execution, allowing for insane stunts on it. That's the horror.

However, if you play the game normally, you'd never know. They did a lot of interesting and fun tricks to make it work, and for that, it's awesome.
See also this LP that focuses on breaking Pokemon Blue.

Spatial
Nov 15, 2007

itt: programmers so bad their own brains have underflowed and now they think it's a positive value

Thermopyle
Jul 1, 2003

...the stupid are cocksure while the intelligent are full of doubt. —Bertrand Russell

ratbert90 posted:

The hardest lesson any programmer or engineer has to learn, is that good code doesn't sell.

It's like evolution. Good enough is all we need.

Suspicious Dish
Sep 24, 2011

2020 is the year of linux on the desktop, bro
Fun Shoe

iospace posted:

To expand on this because that was a phone post:

Pokemon is probably the only thing held together with more matchsticks and rubber bands than this forum. It's easily exploited via arbitrary code execution, allowing for insane stunts on it. That's the horror.

However, if you play the game normally, you'd never know. They did a lot of interesting and fun tricks to make it work, and for that, it's awesome.

your avatar is about 8x as big as all the ram the game has to work with.

it's not held together with matchsticks and rubber bands, it's code that knows its limits and constraints. is it security-sensitive? nope. does it need to be? nope.

Ola
Jul 19, 2004

Suspicious Dish posted:

your avatar is about 8x as big as all the ram the game has to work with.

it's not held together with matchsticks and rubber bands, it's code that knows its limits and constraints. is it security-sensitive? nope. does it need to be? nope.

https://www.youtube.com/watch?v=Vjm8P8utT5g

hackbunny
Jul 22, 2007

I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av

Suspicious Dish posted:

your avatar is about 8x as big as all the ram the game has to work with.

it's not held together with matchsticks and rubber bands, it's code that knows its limits and constraints. is it security-sensitive? nope. does it need to be? nope.

I always got a kick out of the fact that the maximum size of Windows icons (256x256) is very close to, and in some cases exceeds, the screen resolution of most arcade games of the 90s. I used to create high-resolution icons for MAME roms by screenshotting the title screens and cutting out the title/logo (and occasionally rescaling for non-square pixels). The maximum size of macOS icons is 1024x1024 IIRC, so there simply is no contest there

1337JiveTurkey
Feb 17, 2005

I didn't see anything that really struck me as a horror. You jump to the pixels that make up Pikachu's rear end and weird poo poo is going to happen. Yeah, it'd be nice if they checked the boundaries but there's no defensive coding against someone using a gameshark to point your attack subroutine for whatever special ability to a picture of Pikachu's rear end.

Adbot
ADBOT LOVES YOU

netcat
Apr 29, 2008

Suspicious Dish posted:

your avatar is about 8x as big as all the ram the game has to work with.

it's not held together with matchsticks and rubber bands, it's code that knows its limits and constraints. is it security-sensitive? nope. does it need to be? nope.

it does have some very funny bugs though, like the move that is supposed to increase your critical hit rate actually decreases it.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply