iamcal.com Since May 2000

• Happy new year!
• Newbie topic - May 2016
• Newbie topic - April 2016
• Newbie topic - March 2016
• Newbie topic - February 2016
• Newbie topic - January 2016
• Newbie topic - November 2015
• Newbie topic - August 2015
• Newbie topic - July 2015
• Newbie topic - May 2015
• Newbie topic - April 2015
• Newbie topic - March 2015
• Newbie topic - September 2014
• Newbie topic - December 2014
• Newbie topic - October 2014
• Newbie topic - August 2014
• Newbie topic - July 2014
• Newbie topic - June 2014
• Newbie topic - May 2014
• Hello!

Poll:

• Yes
• No

I think he's abusing his power and should not have moderator access!

What does everyone else think

ps. I know this thread won't make any difference but cal should be alerted of the fact that he has a mod who abuses their power

He has abused it a few times, I'm afraid. Nothing against him though.

YOU CAN'T VOTE FOR YOURSELF CHAY!!!! ;)

lol. i only abuse it for fun!
and cos i am most excellent %^^&)*&^()%*^)

ive alreddy been told off for discussing passwords and ive been a good boy since then. in the words of roger rabbit: i only do it when its funny :)

I think I should be able to abuse chays admin powers too

I didn't think it was funny :(

It can be funny but it's fucking annoying most of the time :(

i edited the number "game" cos i found it funny to do so. i shall leave this new game alone now Jimmy.

I've thought about it and come to the conclusion that I don't give a fuck. Is that wrong?

there's no appathy on this thead, biatch

I agree with ILBM. Must be a Scottish thing, not caring.

ilbm - no thats fine :)

I'm voting for chay.

thank you my most excellent friend. %^&*&*(((*£&

I thought the number game thing was funny!

I'm voting Chay also.

23 rawk! cheers rosie
and for those misery guts people then i promise i will keep the time travelling down a bit, perhaps i will keep it to me vicky, reddy and rosies convos

Can I withdraw my vote? Soz Chay.

I voted for chay :)

AP: Shall we ask him about One Can?

Rosie: Yeah, we should.

Despite not giving a fuck I had to vote to see the results. I think that infringes my human rights.

lol
you have to be human to have human rights

looks like some people like me

:P

chay, we all like you :D

I don't. You're a cunt, Chay

:D

fuck you! ;)

Could be worse. If I was mod, I would be constantly correcting people's spelling mistakes.

Except BG's posts, of course, too difficult. It's as if he's burped out a mouthful of scrabble letters sometimes ;)

which would do my nut right in.

Its not that easy to type with a thick stick glued to your forehead

haha!

quote of the day

"It's as if he's burped out a mouthful of scrabble letters sometimes" - quality!

I voted Chay, I think he makes a most excellent moderator :-) he's always editing when the rude boys come along and spoil our fun

not that I'm biased

no, we beleive you

Chay is such an excellent moderator i voted for him again.

^&*%%$%£$%^&£$&

squawk.

although, i'm a bit miffed that this joint doesn't have the security to encrypt passwords, and never warned me of this much.

hmm. i'm not sure whether to:

a) say this somewhere (it'll probably confuse most people)
b) encrypt them (then i can't retrieve them or log in as other people)
c) do nothing (i like this option)

vicky: EXCELLENT *(^&)*%$&*$^&*
Cal: (c) everytime

b)

well, do you REALLY need to log in as other people?

...and instead of retrieving them, you can generate new ones, like lots of other places do.

quack.

yes, i really do.

that told you :)

When he is signed in as you, he can actually see you and what you are doing, so be careful :S

Surely if you encode you can decode? or am I being dense?

not usually, you encode it originally, then you have to encode what is typed into the login box, making it all super safe from hackers, although nothing is really super safe from hackers but there you go

the php function to encode a password makes it so the password is completely not able to be decoded

Except for the decode function I'd assume :/

there is no decode function cos if there was it would make it so easy for someone to find the password and login, making free porn for all

oh I get it now! yes I was being dense

Sorry Sul, I am not too good at explaining things

It wasnt you mate it was me. I was assuming you'd decode the saved(encoded) password and check it against the entered one as opposed to encode the entered one and check it against the saved(encoded) one. Which of course makes much more sense.

I always used to think that would be the best way

correct. you would use crypt(), a one way encryption function

Um, that's not the way to do it atall.
Encode the users password into their database, using their password as an encoding salt.
When you decode, you need the same salt (ie. Password) to decode correctly.

what is with the salt grim...?

Salt is, kind of, a number that the encryption is based on.
Kind of.
Very, very vaguely...

"Um, that's not the way to do it atall."

Cal. Can you please clarify this. I'd actually quite like to know the best way to do this.

what I described was the PHP crypt() function, which I assume cal uses

But there are many other ways of doing it

You described crypt then asked about salting?

And I didn't think Cal used encryption.

Sul: www.hsmx.com/gf5/topics.php?groupid=42

Yeah, I had never heard of salt ing before, its new to me,

I meant if he did use encryption

> GrimCrypt takes the users password and converts it into a string of numbers.

How does it do that then? Does it use a certain method - and if so, surely if someone got access to the db, they would work out that method, and get everyones passwords?

It uses a method based on what the users password is.
See?

So its random then?

I understand what your saying Grim - I'd just be weary that if there was a way to decript there will be a way to hack it.

It's not random...

Lets say your password was 'hi'.
The code turns 'hi' into a number, let's say '14'.
It then encrypts 'hi' with a base of 14, and makes it (for example) 043553.
You can only get 'hi' back from '043553' if you decrypt with the base '14', for which you need to know that the original password was 'hi'.
Make any sense?

why would hi turn into 14 though? There must be a comon method that turns the h into a 1 and the i into a 4 - or is that completely random?

It makes sense, but if you don't know all the passwords to everyone and someone forgets theirs, then you are unable to help and they have to start a new account?

Nov - you could assign a new one.
Jlittle - Yes there's a common method, but it's very difficult to work backwards because a completely different password (say 'who is your daddy') could also equal 14.

Nov if someone looses their password they will ask the forum to make them anotherone sent to their email address that they signed up to it through, and they then can change their password again

I swear the yes has gone up one on this thread

I quite like the idea of using the password as the seed/salt.

seasalt?

grim: your method is NOT secure. encryption is more complicated than you think. php has the crypt() function built in for a reason. use it.

LOL@Sul

That's what I was thinking :-S

Cal: Assuming, of course, that you have a version of PHP with crypt built in.

And my method is lovely and secure, thanks.

Fog: What are you laughing at?

encryption is more complicated than you think

I am in charge of the encryption of all the hardware and software passwords for my company.
I can assure you that it isn't.

Grim - your encription is flawed though - can you not see that?

Assuming there were people out that that *really* wanted the passwords, with a method like that, they could probally find them out.

yeah - using this function written in 10 minutes:
www.iamcal.com/files/cal_crypt.txt

your method is VERY insecure.

using that library and yours, the follow code:



will, sure enough, print "this is a test"

I have to admit Grim... It does seem unsafe, but I never really understood how the crypt function was that safe because could you not use it and enter every word into it and get the encryption, then look at the database they are attacking and find the exact word

according to the manual, crypt() has been built into php since the first release of php3. it's built in to mysql aswell, as the PASSWORD() SQL function.

beargod - with crypt you can't do that because of the salt. sure, you can generate a library of crypted words to use against a single crypted password, but then you couldn't resue it. and it would take a LONG time to do it.

oh ok then

Some builds of PHP don't support Crypt.
Mine, for instance =[

However, nothing is mentioned in the manual about it not being supported in this (and some other) versions.

And although your function looks like it could work, I can't make it =[

It works if you change the numbers in the array to be correct, but I don't know how you'd know what they were...

your build doesn't support crypt? what version/platform and what happens when you call crypt?

use this code:

which array? what correct numbers?

I have version 4.0 of PHP running on Apache 1.3.14 (win32).
If I use crypt I get: Crypt function is not supported in this build.

And when I run that code I get "ta ta s a", but it does work if you get the letter - number corrilation correct in the starting array, but I don't see how you could possibly do that.

"number corrilation correct in the starting array, but I don't see how you could possibly do that."

explain yourself here. i have downloaded your crypt library. whatever i encrypt with it i can decrypt with my function.

'F' => 42,
'G' => 43,
'H' => 44,
'I' => 45,
'J' => 46,
etc...
The numbers you use aren't the same as the numbers I use.

Ak!

I meant to say in the readme file that people should jumble the letter - number codes up, and I forgot *hits head on desk*

unless you can code some sort of uber-funtion to unjumble them, if so just tell me and I will give up now...

all i have to do is create a password a la, "abcdefghijklmnop" and i can see what it's turned into. besides that, you distribute this code with those values HARD CODED IN.

oh, so the answer to your question is yes, easily.

buy this book: www.amazon.co.uk/exec/obidos/ASIN/047111...

it is very good

How would you see what it has been encrypted into?

I have that book =]

I also have this book, which I see is now it's 'perfect partner', which it wasn't a while ago.

"How would you see what it has been encrypted into?"

err, that's a really dumb question. if you can't see what it's been encrypted into, then why bother encrypting it at all?

Sorry - how would the user (or attacker) see what it's been encrypted into, unless he has database access?

no, that's the same question again.

why bother encrypting it at all in that case? the reason to encrypt passwords you store is incase someone DOES see them.

Okay, so lets assume someone does see them
Without knowing what the original function was that encrypted them, whould the nasty cracker be able to decrypt?

Not easily, me thinks.

Plus, it's a whole fuck-load better than having no encryption...

well, then it's a VERY simple case of crypto analysis, assuming that the user can't just register with a known password and see what the ciphertext comes out as. bottom line is, that this isn't encryption, it's simple substitution with a checksum on top. telling people that this is encryption and that it protects their data is a "bad thing" (tm).

it's very slow too. infact, 'cracking' it is faster than encoding it:

--------------------------------------------------------------------------------

1000 iterations of gcrypt() in 33.6457090378 seconds
= 29.7214720271 iterations per second

--------------------------------------------------------------------------------

1000 iterations of crack_gcrypt() in 0.847792983055 seconds
= 1179.5332351 iterations per second

--------------------------------------------------------------------------------

I'm still in agreement with cal here.