Tech. question - GoFuckYourself.com

baycouples · 10-21-2006, 01:35 AM

What is the best way of password protection that you think is the most secure when it comes to keeping your users logged in to the site?

- Cookies session tracking
- Session ID passed from page to page through ID?
- htaccess protection

baycouples · 10-21-2006, 08:40 PM

Did tech. question scare everybody?

GrouchyAdmin · 10-21-2006, 08:42 PM

You can't use session tracking, because that will be destroyed when they close the browser. Cookies allow you to set a cookie until 2038, and htaccess does no tracking other than in your access logs.

If you want to ensure they stay logged in for the duration of the single session, obviously, session length cookies are the best.

Otherwise, I don't really understand the question.

DjSap · 10-21-2006, 08:57 PM

cookie/database is the most commonly used I would think, then again I'm more focused on the design aspect...

baycouples · 10-21-2006, 10:07 PM

Yeah but cookies have to have some sort of a de-cryption on the server and that is a security risk. Why not htaccess password protection? Is there any risk there?

AgentCash · 10-21-2006, 10:29 PM

The main risk with standard .htaccess password protection is from cracking. Next up with both cookies & query sting session variables would be XSS (cross-site scripting) & ref logging allowing an attacker to steal a session. You can't bind the session to the IP address as an IP address can change during a session.

I would use a form based login, with a captcha if crackers were hitting the site. Maybe bind the useragent to the session & if I was really paranoid make all internal links POSTed form based submits.

That's off the top of my head, and I'm pretty tired, but at a glance it seems that would be pretty secure.

GrouchyAdmin · 10-21-2006, 10:31 PM

Quote:

Originally Posted by AgentCash

I would use a form based login, with a captcha if crackers were hitting the site. Maybe bind the useragent to the session & if I was really paranoid make all internal links POSTed form based submits.

Protip: Using both the current time of login and captcha text as salt makes it quite difficult to 'crack' someone's key.

I usually use two seperate keys - the original login, and one that's set on access. If there's more than time_len difference, I force a logout. It keeps people feeling a little secure (if it takes you more than fifteen minutes to rub one out to a single picture before you decide to move on, it's not my problem.)

VexXxed · 10-21-2006, 10:35 PM

Sparta
Strongbox
Pennywize

squishypimp · 10-21-2006, 11:06 PM

check out sparta from www.toomuchmedia.com

teksonline · 10-21-2006, 11:59 PM

Quote:

Originally Posted by toonpornblog

Protip: Using both the current time of login and captcha text as salt makes it quite difficult to 'crack' someone's key.

I usually use two seperate keys - the original login, and one that's set on access. If there's more than time_len difference, I force a logout. It keeps people feeling a little secure (if it takes you more than fifteen minutes to rub one out to a single picture before you decide to move on, it's not my problem.)

heh, captcha, havnt seen many site that wasnt bypassable to date.

go try to bypass nats captcha for example, all you have to do is look at one code copy that code to your server bot, and it will work for all attempts

I had to bypass it to download content zips from a nats sponsor to server and
they forced captcha, LAME THING TO DO!!!

Alky · 10-22-2006, 12:17 AM

Quote:

Originally Posted by teksonline

heh, captcha, havnt seen many site that wasnt bypassable to date.

go try to bypass nats captcha for example, all you have to do is look at one code copy that code to your server bot, and it will work for all attempts

I had to bypass it to download content zips from a nats sponsor to server and
they forced captcha, LAME THING TO DO!!!

http://sam.zoy.org/pwntcha/

there are plenty of captcha's that are VERY tough to beat.

Nathan · 10-22-2006, 04:18 AM

Quote:

Originally Posted by teksonline

heh, captcha, havnt seen many site that wasnt bypassable to date.

go try to bypass nats captcha for example, all you have to do is look at one code copy that code to your server bot, and it will work for all attempts

I had to bypass it to download content zips from a nats sponsor to server and
they forced captcha, LAME THING TO DO!!!

Hi,

small note.. he is talking about the CAPTCHA used on the NATS access template displayed on false login attempts. Not the captcha in SPARTA.

The reason why what he does works is by design, when we added the CAPTCHA in v2 (I think it was v2) we wanted to make transition as easy as possible and show people that its possible to use a captcha if wanted. We did not lockup the login system to force captcha checking.

In SPARTA the process works a lot different and is not bypassable unless it is specifically disabled in the configuration.

teksonline · 10-22-2006, 01:41 PM

btw the term Captcha should be thrown out the window

Please refer to it as "turing"

Not only is captcha, a meaningless word that don't exist, it's a stupid word
and very hard to type.

baycouples · 10-22-2006, 09:29 PM

Quote:

Originally Posted by AgentCash

The main risk with standard .htaccess password protection is from cracking.

Cracking? It's a one way MD5 encryption!!!

Alky · 10-22-2006, 10:41 PM

Quote:

Originally Posted by baycouples

Cracking? It's a one way MD5 encryption!!!

i think he mean't brute force http attempts.

10-21-2006, 01:35 AM	#1
baycouples Confirmed User Join Date: Mar 2004 Location: San Jose, CA Posts: 1,341	Tech. question What is the best way of password protection that you think is the most secure when it comes to keeping your users logged in to the site? - Cookies session tracking - Session ID passed from page to page through ID? - htaccess protection Last edited by baycouples; 10-21-2006 at 01:36 AM..

10-21-2006, 08:42 PM	#3
GrouchyAdmin Now choke yourself! Industry Role: Join Date: Apr 2006 Posts: 12,085	You can't use session tracking, because that will be destroyed when they close the browser. Cookies allow you to set a cookie until 2038, and htaccess does no tracking other than in your access logs. If you want to ensure they stay logged in for the duration of the single session, obviously, session length cookies are the best. Otherwise, I don't really understand the question. __________________ AIM: GrouchyGfy

10-21-2006, 08:57 PM	#4
DjSap Confirmed User Join Date: Jul 2002 Posts: 3,869	cookie/database is the most commonly used I would think, then again I'm more focused on the design aspect... __________________ Blog Themes, TGP Design, Writing Services, Grunt Work ICQ: 66871495

10-21-2006, 10:35 PM	#8
VexXxed Confirmed User Join Date: Sep 2006 Location: What Bitch? Posts: 544	Sparta Strongbox Pennywize __________________

10-21-2006, 11:06 PM	#9
squishypimp PostMaster General Join Date: Aug 2006 Posts: 10,781	check out sparta from www.toomuchmedia.com __________________ Signature For Sale

10-21-2006, 08:40 PM	#2
baycouples Confirmed User Join Date: Mar 2004 Location: San Jose, CA Posts: 1,341	Did tech. question scare everybody?

10-21-2006, 10:07 PM	#5
baycouples Confirmed User Join Date: Mar 2004 Location: San Jose, CA Posts: 1,341	Yeah but cookies have to have some sort of a de-cryption on the server and that is a security risk. Why not htaccess password protection? Is there any risk there?

10-21-2006, 10:29 PM	#6
AgentCash Confirmed User Join Date: Feb 2002 Posts: 720	The main risk with standard .htaccess password protection is from cracking. Next up with both cookies & query sting session variables would be XSS (cross-site scripting) & ref logging allowing an attacker to steal a session. You can't bind the session to the IP address as an IP address can change during a session. I would use a form based login, with a captcha if crackers were hitting the site. Maybe bind the useragent to the session & if I was really paranoid make all internal links POSTed form based submits. That's off the top of my head, and I'm pretty tired, but at a glance it seems that would be pretty secure.

10-22-2006, 01:41 PM	#13
teksonline So Fucking Banned Join Date: Jan 2005 Location: At My Desk Posts: 2,904	btw the term Captcha should be thrown out the window Please refer to it as "turing" Not only is captcha, a meaningless word that don't exist, it's a stupid word and very hard to type.