5 ms·
I once saw a production site that stored the password in plaintext, and then ran base64(base64()) on the result and sent that in a cookie. It still gives me nig
by shanemhansen 11y ago
I once saw a production site that stored the password in plaintext, and then ran base64(base64()) on the result and sent that in a cookie. It still gives me nightmares sometimes. That's what I consider to be criminal incompetence.
- haberman 11y agoI would love to know why the programmer thought the second base64 would help. "No one would ever expect the data to be base64-encoded twice! Mwa ha!"
- sarciszewski 11y agohttps://i.imgur.com/UUEDKYA.jpg https://i.imgur.com/UUEDKYA.jpg
- tedunangst 11y agoProbably. "Looks like gibberish. Base 64 decode it. Still looks like gibberish. Must be random bytes." Never mind that random bytes are not likely to all be ascii letters and numbers.
- startling 11y agoRandom ascii letters and numbers are just as good as random bytes.
- sarciszewski 11y agoSort of. There's less entropy per character if you know it will always be alphanumeric versus a string that of random bytes. If you take 32 bytes from /dev/urandom and base64 encode it, it has the same entropy as the original binary string (unless you use it in a way that will result in it being truncated). But the total entropy of the two strings is unchanged. One is just longer. In short: You're correct, but with nuance that bears stating explicitly.
- tedunangst 11y agoRandom ASCII letters decoded as base64 are unlikely to result in only ASCII letters. And if you generated random letters to start, there's no reason to base64 encode it.
- ams6110 11y agoThat's why I always base64-encode three times. And then swap the first and last character.
- douche 11y agoMan, you gotta rot13 that shit a couple times, just to be extra safe. And make sure you generate a random seed to to seed your RNG with. Twice as random, right?
- MichaelGG 11y agoYeah, I mean the IETF thought one pass of Base64 was good enough for HTTP.
- shanemhansen 11y agoHe knew that something wasn't quite bulletproof with his "encryption" scheme. He left a comment: "Won't stop 1337 hackers".
- nnd 11y agoShould've bese64-encoded one more time just in case to add another layer of security.
- sarciszewski 11y agoYou mean sort of like this? (From the article.) https://paragonie.com/files/blog/base64_password.png https://paragonie.com/files/blog/base64_password.png
- rcurry 11y agoOh, you're going to love this - I worked for a firm that developed electronic trading software, back in the late 90s. They "encrypted" their incoming connections with a simple XOR scheme that used a "key" which was, basically, a random number. You want to guess how they generated the random number? They seeded the random function with the current time... now, almost all of their clients would just leave their trading systems running overnight, so in the morning all the clients would reconnect at just about the exact same time (market open), so then 90% of the clients would end up using the same "key" to encrypt their sessions. Now, ordinarily it would be bad enough that almost all of your clients are using the same encryption key, but it got much worse from here - turns out there was a bug in a proxy server they had written, so that every once in a while client B's traffic would be routed into client A's session, and hilarity would ensue; because the "keys" were the same, Client B's traffic looked like normal traffic from client A, so nobody could ever figure out why Client A would call us up and complain that he was getting fills for orders that he'd never sent! It took me forever to figure out WTF was going on, but one day I was watching a logging display and noticed garbled traffic showing up in Client A's logs, and it was garbled because it was a user who actually didn't auto-logon at 0930 in the morning and subsequently had a different encryption "key" resulting in his traffic not being decoded properly. From there, it became obvious what the problem was. Edit: Yeah, yeah, I know - you're thinking "Wait, XOR? shared secret? But, but... how did they do key exchange?" Well, how the heck else would you send a client the secret key for the session - in plain text, when the client first logs on, of course!