Posted by
cal, 16:08, 20th June 2003:
New articles by me:
Designing user authentication systems
The problem with cookie authentication
There are also a whole bunch of new articles added to
the publish section which were going to be in Ben Hammersley's "Blog Hacks" book (which, sadly, O'Reilly decided not to publish).
Posted by
tef, 14:58, 23rd June 2003:
I've got some ideas here... espcially on the problems with cookies authentication, when I can type coherent sentences I'll write it up :)
And I have noticed the problems you mentioned in the article are still on your site. (don't worry I wont be nasty)
Posted by
cal, 15:26, 23rd June 2003:
on iamcal? yeah, they are. there are probably a whole load of things wrong with this site, but thenm it doesn't matter too much since all that can be done is editing posts and the full edit history is tracked.
but for more public sites where there are potentially dangerous admin functions, it's worth going to the trouble of securing holes like this.
Posted by
tef, 00:40, 24th June 2003:
void.printf.net/~tef/auth.html
i've stuck a few incoherent ramblings here.
Posted by
Grim..., 09:18, 24th June 2003:
Um, you hacked B3ta?
I think Cal might get a bit upset about that...
Posted by
cal, 10:40, 24th June 2003:
I know he did. He helpfully told us all about it and we patched the holes.
The only bit of your article i don't agree with is this bit:
Cal here assumed that you could write a script to get around this by simulating the POST request. The problem with this is that you need access to the users session data. So really, you could just pretend tio be them and just use the form provided. The way around this, is if you can post arbitary html anywhere on the site (so you can access the cookies), is you post a form with all the values set and hidden and encourage the users to click on the button (or force it with a script...).
Whilst the way i outlined doesn't make sense (oops), it's still pretty possible if you can get the user to run some javascript (as you said). BUT, i believe, you can get IE to run JS for an image by doing something like:
<img src="#long_code_to_create_and_submit_form">
which wouldn't work on b3ta because "#" is filtered, but would work elsewhere.
Posted by
cal, 10:43, 24th June 2003:
i think it's also worth pointing out that all of these issue are only relevant when you run a site that allows people to post content.
and even then, if you make sure you always use htmlentities() or similar, you wont run into problems. the problems come when you need to let users post some html, and/or you forget to use htmlentities() (even in the silliest of places, like the search results page. oops)
Posted by
cal, 10:46, 24th June 2003:
oh, also this:
Using it in the URL has no advantages over cookies
well, it has quite a big advantage - it works on all browsers, regardless of cookie settings.
Posted by
Grim..., 10:47, 24th June 2003:
=]
Posted by
cal, 10:55, 24th June 2003:
crap. i just realised iamcal use the same filtering code as b3ta
the # in the above message should read "java script:" minus the space
Posted by
Grim..., 11:36, 24th June 2003:
Does that mean if someone posted requesting some javascript help, it would all go wrong?
<script language="javascript">
Posted by
Grim..., 11:36, 24th June 2003:
No.
Yay Cal!
Posted by
cal, 12:00, 24th June 2003:
read carefully. you have to add a colon on the end
Posted by
tef, 13:29, 24th June 2003:
admittedly I'm not that great at making sense.
but I can see the javascript cunningness.
and didn't think about the fact that url works everywhere
(although even lynx accepts cookies...)
and yes, most of them are a direct result of allowing people to post content.
cheers :)
Posted by
cal, 13:33, 24th June 2003:
although lynx cupports cookies, i know alot of (annoying) people who turn cookies off, and lots who (like me) vert all cookies before accepting them
Posted by
tef, 14:03, 24th June 2003:
hmm.
another option is to bidn the cookie to the ip
(but making it an option as it doesn't work for everyone...)
Posted by
cal, 14:34, 24th June 2003:
yeah - not a great idea for people on dhcp networks that renew leases quickly. or for peple with caches, etc.
Posted by
tef, 14:47, 24th June 2003:
doesn't php have a session module included?
however, I do feel like writing a web authentication guide - more of a why so than a how to
would you willing to nitpick :)
Posted by
cal, 14:58, 24th June 2003:
it sort of does - it has user session tracking but it seems to work in bizarre ways - you don't choose how and when to pass tokens, etc. the bit that it does do is the easy part of making your own authentication system.
i'd be very willing to nitpick - it's the sort of thing that i should really write myself anyway
Posted by
cal, 15:05, 24th June 2003:
tef - are you london pm's chris ball?
Posted by
tef, 15:15, 24th June 2003:
no, but i know him :)
he runs void.printf.net
he is choric, i'm tef. i'm at ed.ac.uk
also, were you at xcom2002 by any chance?
Posted by
tef, 15:18, 24th June 2003:
and
is what I look like
Posted by
Sul, 15:21, 24th June 2003:
dont take this the wrong way but you're a pretty good looking fella for a geek. How'd that happen?
Posted by
tef, 15:26, 24th June 2003:
genetic freak.
weirdly enough, people say i'm cute
in drag (I went to a henight)
Posted by
Sul, 15:36, 24th June 2003:
errr very sexy :)
Posted by
tef, 15:38, 24th June 2003:
why thank you. i'm just trying to decide why I might be choric.
it's a bit odd that.
giant conspiracy notes: i found this entry from diepunyhumans -> blackbeltjones -> haddock -> cal.
Posted by
Grim..., 15:53, 24th June 2003:
I like your T-Shirt =]
Posted by
Sul, 16:05, 24th June 2003:
OMG! I am so turning gay! I didnt even notice the t-shirt :O
Nice one.
Posted by
cal, 16:33, 24th June 2003:
i *was* at xcom - did i speak to you there?
i thought you might be him since your email address is a printf one
Posted by
tef, 16:36, 24th June 2003:
aaah. i use the ed.ac.uk mainly, but used tef-testing for the pissing around account.
possibly. I had a unicycle
and went on stage to give a presentation on dodecahedrons.
one of these(hooj)
Posted by
cal, 16:44, 24th June 2003:
ahh - didn't see that
Posted by
tef, 16:47, 24th June 2003:
curses.
we made one out of phone box flyers .too.
Posted by
tef, 16:48, 24th June 2003:
how do you know chris then
london.pm i'm assuming
Posted by
cal, 17:24, 24th June 2003:
know of, not know. via london.pm
Posted by
tef, 04:24, 26th June 2003:
void.printf.net/~tef/misc/authentication...
i've had a quick draft on how I plan on implementing
web authentication. any ideas?
Posted by
cal, 10:48, 26th June 2003:
before i read it - what's this about namejacking/paces/\n's/invisible names?
Posted by
tef, 13:59, 26th June 2003:
hehe
I copied update profile and changed an input to a textarea.
and then changed my name to newlines.
sunshine elephant then worked out that if you put a space before the name it kinda showed up the same.
I used a \nrob, and we confused the fuck out of the board.
If you just use \n, your name is invisible
by \n i mean actually typing enter %0D%0A, because backslashes seem to kill usernames at the moment :) (as can be seen in id 2985 - whoops )
Some comments on it that make a bit more sense are at:
www.livejournal.com/users/figg/49521.htm...
