• the real foo (unregistered) in reply to DigitalLogic
    DigitalLogic:
    The real WTF is blaming the security library which has obviously been used in other applications instead of debugging your own code.


    It's not. To debug your own code, you have to check the parts where it interacts with other code.
    To tell you messed up a system call, you need to know that calls syntax and semantics.
    To tell you did something wrong in regard to a library, you need information on that library.
    In general, to debug your own code, you need documentation (and, if possible, source) of the code it has to work with.

    So it is completely correct he wants to check that "security library", so he can find out where the bug is.
  • (cs) in reply to Oli

    As stated in early posts to this thread, VBScript will execute both function calls in the first 'if' statement.  Regardless of whether or not the result of the first function call alone determines the conditional.

  • (cs) in reply to the real foo
    Anonymous:
    DigitalLogic:
    The real WTF is blaming the security library which has obviously been used in other applications instead of debugging your own code.


    It's not. To debug your own code, you have to check the parts where it interacts with other code.
    To tell you messed up a system call, you need to know that calls syntax and semantics.
    To tell you did something wrong in regard to a library, you need information on that library.
    In general, to debug your own code, you need documentation (and, if possible, source) of the code it has to work with.

    So it is completely correct he wants to check that "security library", so he can find out where the bug is.


    That's true if you're making a system call.  However, he was not making any function calls into code in the included file.  The only way it could have presented a problem to him were if:
    A) The code in the included file redirected him to another page.
    B) The code in the included page modified global variables that he used.

    The lack of documentation of code that he had to use is definately a WTF, but I don't think he should have needed the source code in order to debug.  Its along the lines of saying you can't debug C code because you only have header files to code you are linking to.  Sure there could be problems in the code you're linking to, but a seasoned programmer should be verifying what they did before they start pointing the finger at another piece of code.
  • Greg (unregistered) in reply to drdamour
    drdamour:

    Anonymous:


    However, you haven't given us an example of this.  While your telnet example may be more secure, at the root it still requires secret data, namely a password.  I can imagine scenarios where the delaying tactic could be subverted, such as through a distributed attack.

    You are correct, i did NOT give you a good example of this.

    Take the same system, but instead of there being a password for access, instead there was simply a command called "off". "off" is completely secure, noone should be able to invoke it. Every time someone does, "off" will warn you and make you timeout for (n)*5 seconds, where n is the number of times you've invoked the "off" command. now no password, but there is security.

    sure it's a crappier example, but it does prove that punishment and passkeys are seperate concepts of security. We see this every day in banks. Yes you should have an account and passphrase or key to transfer out money of a bank's lockbox, but you can brute force your way in (maybe with a gun & crowbar) and get the money. What is the security for that? mostly the deterent of the punishment of getting caught, or the possibility of being injured in the attempt. the punishment, a form of security that certainly is not obscure.


    Well, drdamour, we're just going to have to agree to disagree.  The rule of law isn't security.
    As an example, if I leave the front door of my house wide open, and someone comes in off the street & steals my TV, the rule of law did nothing to stop the person.  The police will laugh at my "security system".  As will my insurance company.  If I were employed as a security person & this happened in the course of my job, I would be fired, and rightfully so.
    While the rule of law is a deterrent, it is most definitely not security.

    As
  • fajensen (unregistered)

    That's the kind of security I would like to see on pr0n sites ;-)

  • (cs) in reply to savar

    savar:
    But with public-key cryptography, the equation changes considerably. The end game is to max out the key space.With 64 bit keys, we get an expected value of 2^64/2 = 9.2e18 keys that need to be brute-forced. A huge number, but not impossible to brute-force. If you can test 1 billion keys per second, then you have an expected value 292 days to recover the key.

     That depends on which key you're talking about. We've already factored RSA-640: http://en.wikipedia.org/wiki/RSA_Challenge

    It works because you don't need to divide by every prime between 2 and sqrt(2^640).

     

  • (cs) in reply to mkb

    mkb:
    All computer security is through obscurity, except biometric security.

    Amazing complete lack of understanding of what biometrics are. In fact, biometrics are no different from passwords. It just takes more effort to generate a new person than it does to generate a new password.

    You need to check that the measurements are of a real person, and that the person is willing. Fingerprints can be faked using gelatine (cast it into a mould, and you can print a mould with a PCB), and we can't be too far from faking retina and iris scans. And then you can get someone with a fake eye or get skin grafts.

    Ultimately, you need to measure the brain and also take input from the brain, and somehow determine whether they're the same brain. All other body parts can be chopped off (I'm going with the one-brain-per-person theory).

    This is the big problem with biometric security, yet governments are still pushing for it. And they still only take a fingerprint..

    (captcha:enterprisey, and then I logged in) 

  • (cs) in reply to Carnildo

    Carnildo:
    No, session-based web systems will usually hand the client a session ID (I use a combination of the username, user IP address, and current time), then store a copy in the local database. You can't generate a valid token out of thin air because you can't get the database to store it, you can't move a token from one computer to another because the IP address of the original computer is stored in the database, and you can't re-use a token at a later date because the time the token was generated is stored in the database.

    I use a combination of the username, user IP address, and current time

    256-bit random number.

    you can't move a token from one computer to another because the IP address of the original computer is stored in the database

    IP-spoofing. And some ISPs have multiple transparent proxies, so you may not actually come from the same IP all the time.

    you can't re-use a token at a later date because the time the token was generated is stored in the database

    Limiting the amount of time you can attack for is not security.

  • (cs) in reply to RyuO

    RyuO:
    Well, sometimes. The most critical apps, the ones that handle money, are controlled by the few corporate people who know the value of a dollar (sorry for the Americanism). Therefore they'll tend to be lean and to have stood the test of time. This type of app is not likely to cause security issues; it is more likely to be secure from the ones who are supposed to use it.

    No, the most critical apps are the ones with important passwords. Security is only as strong as the weakest link.

    What would happen if I waited for everyone to leave, and then looked under all the keyboards?
     

  • (cs) in reply to ole gustie

    ole gustie:
    I know vb.net provides "AndAlso" and "OrElse" operators that will do the optimized boolean comparisons.  Not positive, but I think that earlier versions of VB provide those operators as well.  That said, I don't understand why VB gives the programmer the option to use "And" vs. "AndAlso".  Can anyone think of a reason where evaluting all expressions, even after the boolean logic has been satisifed, is desired behavior?

    Because sometimes you want to (I haven't encountered such a situation yet).

    Other times it's actually more efficient. The time taken for a mispredicted branch is a lot longer than the time taken to do a few bitwise ops, so it's faster to compute a&b&c and then compare/branch, than it is to compare a, conditionally branch, compare b, conditionally branch, compare c, conditionally branch (if a,b,c are local variables and vaguely random).

    This is slightly CPU dependant, though. 

  • Ol' Bob (unregistered)

    This appears to be standard practice. "Hello? Mr. Contractor? Yes, we're with Corporate IT's Revenue De-justment group, and we're here to help you...fail. You say you've been working on this system for three months and you can't get paid until it's installed and working? Yes, well, we're here to prevent that. That's right - you're now a little thing we like to call "screwed". Have a great day! And say hi to all the nice folks at the soup kitchen..."

  • someone (unregistered)

    I'll take "reading to much Dilbert(tm) and starting to talk like the P.H.B.(tm)" for $500, Alex!

Leave a comment on “Secret Enterprise Security”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article