5 ms·

Building Password Purgatory with Cloudflare Pages and Workers

107 points by robin_reala 5y ago

_nhynes 5y ago
You don’t need the bespoke Wrangler workflow now with Pages Functions [0]. Just drop the scripts in the `api/` directory in the page repo. [0]: https://developers.cloudflare.com/pages/platform/functions/ https://developers.cloudflare.com/pages/platform/functions/
- robertlagrant 5y ago
  I'm glad they're more combined now. It was annoying figuring out Pages and wrangler for web / functions respectively.
YPPH 5y ago
I always figured those SEO spammers sent bulk emails using automated or semi-automated tools. I have my doubts they will follow through on "registering" for one person's website.
- rpicard 5y ago
  Only one way to find out!
  - netsharc 5y ago
    He should've done market research to see if the spammer would've even bitten.
MBCook 5y ago
You can find the in-progress list of checks in this source file: https://github.com/troyhunt/password-purgatory-api/blob/master/index.js https://github.com/troyhunt/password-purgatory-api/blob/mast... It includes such gems as requiring the sum of all digits in the password to be divisible by 3, requiring passwords to contain Simpsons/Family Guy character names, emoticons, ending with “dog”, and all sorts of other craziness. Can’t wait to see his results.
- hayd 5y ago
  even worse than the sum: "Password when stripped of non-numeric characters must be a number divisible by 3", considering it needs a valid zip and three digits of pi that starts to get non-trivial!
  - WayToDoor 5y ago
    Can't you just add an extra number?
- ssl232 5y ago
  Looking at the list I think it might be possible to pass all the tests (please correct me if I'm wrong). Maybe there needs to be a catch-all test that always fails?
  - petesergeant 5y ago
    “Sorry, another user in our system has that password”
    - maccard 5y ago
      Sorry user X has that password. Please contact the at: <their email> to ask them to change it.
    - stavros 5y ago
      Oh wow, evil.
- ssl232 5y ago
  It lacks the most infuriating rule found in the wild, an upper limit on the length of the password (that's not at least in the thousands due to e.g. request size limits).
  - charcircuit 5y ago
    Assuming an random alphanumeric password and a 256 bit hash there is no benefit going above a 55 character password. Even if you aren't just using random characters I think 100 is a fine limit. Most people are not going to be using a password that long without a password manager. If they are using a password manager they might as well just use a random password. For there to be more security in allowing passwords thousands of digits long the host would very likely being storing your password in plain text as opposed to pulling out a few thousand bytes out of an XOF (extendable output function).
throwaway14356 5y ago
for forum spammers i made a super hard to read super long capcha "service" where every atempt is wrong.
- yewenjie 5y ago
  How do you make sure genuine users can use the forums?
  - passerby1 5y ago
    Maybe today genuine users use facebook and reddit only? /sarcasm
deleted 5y ago
[deleted]
systemvoltage 5y ago
I wish Cloudflare supported Python for Workers/Functions. There is some weird translation from Python to Javascript which seems extremely bloated. I just want to run Python for the backend, natively. One day, we can deploy Flask apps through Cloudflare edge nodes, that would be cool.
- robertlagrant 5y ago
  They only use the Chrome v8 engine to host their serverless stuff, so everything has to transpile to Javascript or compile to WASM. If v8 doesn't run it, it's not running in their edge. I think it's a good idea; cheap runtimes and no cold start penalty are a good combination.
- ekimekim 5y ago
  One of the major reasons all these kinds of services use javascript is that it can be reliably sandboxed (it needs to be, so it can run in a browser without every random website getting control of your machine). While there's nothing in theory preventing you from doing a similar thing with python, an implementation with the same hardening just doesn't exist. CPython sandboxes have been broken over and over again, to the point that conventional wisdom is "the only way to sandbox python is to run it in a VM". The only other language I can think of offhand that has similar levels of sandboxing is Lua.
  - deleted 5y ago
    [deleted]
  - systemvoltage 5y ago
    How does AWS lambda work? From what I can see, it runs python natively. https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes...
    - brody_hamer 5y ago
      Im guessing it’s LVM based. (ie: containers)
petesergeant 5y ago
As a back-end developer, I was recently impressed by how quickly I was able to get up and running with Vercel, having started a vanilla JS project with Vite. Single change to my DNS records, and it's all setup at a custom domain in no time. If I was doing this project, I'd probably do it like that? UPDATE: I'm procrastinating other projects. https://grou.ch https://grou.ch (or https://passwordpurgatory.vercel.app/ https://passwordpurgatory.vercel.app/ if DNS hasn't propogated yet) Times taken: 45s run vite 8m basic vanilla HTML scaffold 4.5m add some better password rules 1.75m setup in Bitbucket 1m Add to Vercel 1.5m setup custom domain If I wanted to capture attempts, I'd probably do it via Google Analytics? It's magic to me how quick this tooling is -- just over 15m to get this up on the internet, https etc, domain, from literally nothing.
- DoctorOW 5y ago
  Vercel is very similar to Cloudflare Pages/Workers. I wouldn't really worry about one over the other.
- rafaele 5y ago
  Password must contain at least one tab character. Good one :)
- ryan29 5y ago
  I've never used Vercel, but skimming their site I think it's roughly the same concept as Cloudflare Pages / Functions. SvelteKit has adapters [1] for both Cloudflare and Vercel (and Netlify), so they must be reasonably similar. I think Vite is a similar idea. I've never used it either, but have seen some references to Cloudflare deployment via a plugin. The basic concept is really compelling IMO. 1. https://kit.svelte.dev/docs/adapters#supported-environments https://kit.svelte.dev/docs/adapters#supported-environments
gnyman 5y ago
In a similar spirit there is http://spa.mnesty.com http://spa.mnesty.com and https://twitter.com/rescambot https://twitter.com/rescambot , the first one which is more simple and the second which has been discontinued. Re:scam seemed quite good at what it did https://imgur.com/a/rrHi2 https://imgur.com/a/rrHi2 Does anyone know of any other service? I've had varying success with spamnesty , if I recall it does (or did) just have a list of non-answers it picked randomly from. While the Re:scam seemed to use some kind of ML to generate more relevant answers.
- stavros 5y ago
  > it does (or did) just have a list of non-answers it picked randomly from Yes, this is true (I made Spamnesty). Lately the scammers have mostly stopped responding and just use bots, so it's all a list of bots replying to bots, and thus much less entertaining.
MichaelMoser123 5y ago
cloudlflare has an anti-ddos feature that makes it hard to scrap pages. This feature involves a number of http redirects, and at some stage they need to run javascript in order to get to the next step. The only fix was to scrap these pages was by means of automating the browser with selenium. I was scrapping a big number of web pages for my project here https://github.com/mosermichael/duckduckbang https://github.com/mosermichael/duckduckbang Had to get the description of the sites used by duckduckgo bang operators, so i wrote my own scanning system too...

107 points by robin_reala 5y ago

You don’t need the bespoke Wrangler workflow now with Pages Functions [0]. Just drop the scripts in the `api/` directory in the page repo. [0]: https://developers.cloudflare.com/pages/platform/functions/ https://developers.cloudflare.com/pages/platform/functions/

robertlagrant 5y ago
I'm glad they're more combined now. It was annoying figuring out Pages and wrangler for web / functions respectively.

YPPH 5y ago

I always figured those SEO spammers sent bulk emails using automated or semi-automated tools. I have my doubts they will follow through on "registering" for one person's website.

rpicard 5y ago
Only one way to find out!
- netsharc 5y ago
  He should've done market research to see if the spammer would've even bitten.

MBCook 5y ago

You can find the in-progress list of checks in this source file: https://github.com/troyhunt/password-purgatory-api/blob/master/index.js https://github.com/troyhunt/password-purgatory-api/blob/mast... It includes such gems as requiring the sum of all digits in the password to be divisible by 3, requiring passwords to contain Simpsons/Family Guy character names, emoticons, ending with “dog”, and all sorts of other craziness. Can’t wait to see his results.

hayd 5y ago
even worse than the sum: "Password when stripped of non-numeric characters must be a number divisible by 3", considering it needs a valid zip and three digits of pi that starts to get non-trivial!
- WayToDoor 5y ago
  Can't you just add an extra number?
ssl232 5y ago
Looking at the list I think it might be possible to pass all the tests (please correct me if I'm wrong). Maybe there needs to be a catch-all test that always fails?
- petesergeant 5y ago
  “Sorry, another user in our system has that password”
  - maccard 5y ago
    Sorry user X has that password. Please contact the at: <their email> to ask them to change it.
  - stavros 5y ago
    Oh wow, evil.
ssl232 5y ago
It lacks the most infuriating rule found in the wild, an upper limit on the length of the password (that's not at least in the thousands due to e.g. request size limits).
- charcircuit 5y ago
  Assuming an random alphanumeric password and a 256 bit hash there is no benefit going above a 55 character password. Even if you aren't just using random characters I think 100 is a fine limit. Most people are not going to be using a password that long without a password manager. If they are using a password manager they might as well just use a random password. For there to be more security in allowing passwords thousands of digits long the host would very likely being storing your password in plain text as opposed to pulling out a few thousand bytes out of an XOF (extendable output function).

throwaway14356 5y ago

for forum spammers i made a super hard to read super long capcha "service" where every atempt is wrong.

yewenjie 5y ago
How do you make sure genuine users can use the forums?
- passerby1 5y ago
  Maybe today genuine users use facebook and reddit only? /sarcasm

deleted 5y ago

[deleted]

systemvoltage 5y ago

I wish Cloudflare supported Python for Workers/Functions. There is some weird translation from Python to Javascript which seems extremely bloated. I just want to run Python for the backend, natively. One day, we can deploy Flask apps through Cloudflare edge nodes, that would be cool.

robertlagrant 5y ago
They only use the Chrome v8 engine to host their serverless stuff, so everything has to transpile to Javascript or compile to WASM. If v8 doesn't run it, it's not running in their edge. I think it's a good idea; cheap runtimes and no cold start penalty are a good combination.
ekimekim 5y ago
One of the major reasons all these kinds of services use javascript is that it can be reliably sandboxed (it needs to be, so it can run in a browser without every random website getting control of your machine). While there's nothing in theory preventing you from doing a similar thing with python, an implementation with the same hardening just doesn't exist. CPython sandboxes have been broken over and over again, to the point that conventional wisdom is "the only way to sandbox python is to run it in a VM". The only other language I can think of offhand that has similar levels of sandboxing is Lua.
- deleted 5y ago
  [deleted]
- systemvoltage 5y ago
  How does AWS lambda work? From what I can see, it runs python natively. https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes...
  - brody_hamer 5y ago
    Im guessing it’s LVM based. (ie: containers)

petesergeant 5y ago

As a back-end developer, I was recently impressed by how quickly I was able to get up and running with Vercel, having started a vanilla JS project with Vite. Single change to my DNS records, and it's all setup at a custom domain in no time. If I was doing this project, I'd probably do it like that? UPDATE: I'm procrastinating other projects. https://grou.ch https://grou.ch (or https://passwordpurgatory.vercel.app/ https://passwordpurgatory.vercel.app/ if DNS hasn't propogated yet) Times taken: 45s run vite 8m basic vanilla HTML scaffold 4.5m add some better password rules 1.75m setup in Bitbucket 1m Add to Vercel 1.5m setup custom domain If I wanted to capture attempts, I'd probably do it via Google Analytics? It's magic to me how quick this tooling is -- just over 15m to get this up on the internet, https etc, domain, from literally nothing.

DoctorOW 5y ago
Vercel is very similar to Cloudflare Pages/Workers. I wouldn't really worry about one over the other.
rafaele 5y ago
Password must contain at least one tab character. Good one :)
ryan29 5y ago
I've never used Vercel, but skimming their site I think it's roughly the same concept as Cloudflare Pages / Functions. SvelteKit has adapters [1] for both Cloudflare and Vercel (and Netlify), so they must be reasonably similar. I think Vite is a similar idea. I've never used it either, but have seen some references to Cloudflare deployment via a plugin. The basic concept is really compelling IMO. 1. https://kit.svelte.dev/docs/adapters#supported-environments https://kit.svelte.dev/docs/adapters#supported-environments

gnyman 5y ago

In a similar spirit there is http://spa.mnesty.com http://spa.mnesty.com and https://twitter.com/rescambot https://twitter.com/rescambot , the first one which is more simple and the second which has been discontinued. Re:scam seemed quite good at what it did https://imgur.com/a/rrHi2 https://imgur.com/a/rrHi2 Does anyone know of any other service? I've had varying success with spamnesty , if I recall it does (or did) just have a list of non-answers it picked randomly from. While the Re:scam seemed to use some kind of ML to generate more relevant answers.

stavros 5y ago
> it does (or did) just have a list of non-answers it picked randomly from Yes, this is true (I made Spamnesty). Lately the scammers have mostly stopped responding and just use bots, so it's all a list of bots replying to bots, and thus much less entertaining.

MichaelMoser123 5y ago

cloudlflare has an anti-ddos feature that makes it hard to scrap pages. This feature involves a number of http redirects, and at some stage they need to run javascript in order to get to the next step. The only fix was to scrap these pages was by means of automating the browser with selenium. I was scrapping a big number of web pages for my project here https://github.com/mosermichael/duckduckbang https://github.com/mosermichael/duckduckbang Had to get the description of the sites used by duckduckgo bang operators, so i wrote my own scanning system too...