The Daily WTF: Curious Perversions in Information Technology

2010-09-15 Reply Admin

It's necessary to do it this way for embedded systems.

Cbuttius · 2010-09-15 Reply Admin

Mark Harrison:
TRWTF is offcourse it only catches 'IndexOutOfRangeException', what about FileNotFound?

I suppose though that in this case as passwords are so special, it should be fish, or even more likely phish.

2010-09-15 Reply Admin

My password is just the letter 'a'.

2010-09-15 Reply Admin

BG:
In TheDailyWTF comment system you can type your password in and it appears as *'s!. For instance, if you typed 'hunter2' it would appear to me as '*******'

BG♥sCoCK

Did it work?

2010-09-15 Reply Admin

Believe it or not, this is how TD Canada Trust's (Canada's second largest financial institution) online banking works.

They only allow for a password up to 8 characters. If you enter more than 8 characters the system truncates anything beyond 8 chars and validates.

Other things about TD Canada Trust's passwords:

Password can only be 5-8 characters in length
no special characters are allowed
System does not differentiate between upper and lower case.

I've raised these issues with their support team however they state that these faults are actually features. They even said that because hundreds of people forget their passwords that they are willing to sacrifice a little security for ease of use.

2010-09-15 Reply Admin

barc0de:
BG:
In TheDailyWTF comment system you can type your password in and it appears as *'s!. For instance, if you typed 'hunter2' it would appear to me as '*******'

Haha, very funny, do you really think i would give you my ******** that easily

Dear barc0de,

In case you can’t tell, this is a grown-up place. The fact that you insist on using your ridiculous handle clearly shows that you’re too young and too stupid to be using thedailywtf.com.

Go away and grow up.

Sincerely,

2010-09-15 Reply Admin

hunglikeahorse

oh cool it works!

2010-09-15 Reply Admin

Sales guy:
My password is just the letter 'a'.

Sales guy, I've reset your password to "password".

Silfax · 2010-09-15 Reply Admin

Dave:
Believe it or not, this is how TD Canada Trust's (Canada's second largest financial institution) online banking works.
They only allow for a password up to 8 characters. If you enter more than 8 characters the system truncates anything beyond 8 chars and validates.

Other things about TD Canada Trust's passwords:

Password can only be 5-8 characters in length

no special characters are allowed

System does not differentiate between upper and lower case.

I've raised these issues with their support team however they state that these faults are actually features. They even said that because hundreds of people forget their passwords that they are willing to sacrifice a little security for ease of use.

5-8 characters, also makes sense. No sense in using more characters than your average user can count up to.

No special characters allowed, makes sense also it is after all a pass 'word' not a pass '%_Qw987-P='

ignore case - this feature makes sense, this way your typical Canuckistani CAN LEAVE THE CAPS LOCK KEY ON AT ALL TIMES

2010-09-15 Reply Admin

frits:
You guys laugh, but this is the exact code the CLR uses for String.Equals(), except they use a loop over a switch for optimization.

This is nothing like the code that .NET uses for String.Equals(). They call an internal unsafe method called EqualsHelper() which does a while loop over the two Char arrays to check them character by character.

2010-09-15 Reply Admin

JSelf:
ctrl+c/v the ********

Whatever version of Netscape my junior high school had installed on their Mac Colour Classic IIs actually let you do this. Someone had typed in a password on a web page then walked away from the computer. CMD-C and CMD-V and it actually showed up in the address bar. I couldn't believe it.

hoodaticus · 2010-09-15 Reply Admin

The company-wide common code library is TRWTF.

2010-09-15 Reply Admin

So if I pass two empty strings it will return false?

2010-09-15 Reply Admin

Anonymous:
I like to think that there's always a more complicated way to do string comparisons. Comparing byte arrays is a nice over-complication but I've seen better.

You said it. I'm sure he could have used recursion somewhere.

2010-09-15 Reply Admin

Dave:
Believe it or not, this is how TD Canada Trust's (Canada's second largest financial institution) online banking works.
They only allow for a password up to 8 characters. If you enter more than 8 characters the system truncates anything beyond 8 chars and validates.

Oh, my.

Other things about TD Canada Trust's passwords:

Password can only be 5-8 characters in length

Oh, dear.

2) no special characters are allowed

Oh my goodness.

3) System does not differentiate between upper and lower case.

Oh, my stars and garters.

I've raised these issues with their support team however they state that these faults are actually features. They even said that because hundreds of people forget their passwords that they are willing to sacrifice a little security for ease of use.

If the bank wants to give user passwords away, why don't they just sell the password file? It would probably be worth a few nickels.

2010-09-15 Reply Admin

Hashini:
hunglikeamouse oh cool it works!

FTFY.

2010-09-15 Reply Admin

highphilosopher:
frits:
You guys laugh, but this is the exact code the CLR uses for String.Equals(), except they use a loop over a switch for optimization.

This is nothing like the code that .NET uses for String.Equals(). They call an internal unsafe method called EqualsHelper() which does a while loop over the two Char arrays to check them character by character.

Actually to be pedantic it does full int comparisons for the bulk of the string then Chars for the rest.

Also it has the whole pass1.Length != pass2.Length check that that might have (slightly) improved the original code.

2010-09-15 Reply Admin

BG:
In TheDailyWTF comment system you can type your password in and it appears as *'s!. For instance, if you typed 'hunter2' it would appear to me as '*******'

Ahah!, good ol' bash.org

2010-09-15 Reply Admin

TRWTF is recycling.

hoodaticus · 2010-09-15 Reply Admin

highphilosopher:
frits:
You guys laugh, but this is the exact code the CLR uses for String.Equals(), except they use a loop over a switch for optimization.

This is nothing like the code that .NET uses for String.Equals(). They call an internal unsafe method called EqualsHelper() which does a while loop over the two Char arrays to check them character by character.

Then frits is right, jackass. Or do you think there's a meaningful difference between a while loop and the implementation in the sample?

The RWTF here is not using the built-in library.

ekolis · 2010-09-15 Reply Admin

Corrected catch block:

catch (IndexOutOfRangeException ex) { throw new OhMyGodStringsAreActuallyDifferentLengthsException("something went horribly wrong", ex); }

2010-09-15 Reply Admin

Cbuttius:
The Nerve:
public static bool passwordsMatch(string pass1, string pass2)
{
    return pass1.Equals(pass2);
}
Not the same logic. pass1 must be a left-subset of pass2 but doesn't have to be equal to it.

You're joking (I hope), but I've worked with developers who, if you suggested replacing the original code (their code) with the above fix, would use the difference in logic as a justification NOT to allow the fixed code. Never mind that it's the original's logic that is flawed.

2010-09-15 Reply Admin

In some systems it actually is important to hold passwords as something other than String. Because in Java and C# String is immutable, it's rather difficult to remove the password from memory once it is no longer needed. That opens it up to attack from eg malware that scans the PC's memory (or possibly worse, swapfile). If the password is captured into a char[] instead, the array can be overwritten as soon as it is finished with.

2010-09-15 Reply Admin

I guess this is much shorter!

public static bool passwordsMatch(string pass1, string pass2) { return pass2.StartsWith(pass1); }

2010-09-15 Reply Admin

LOL @ IRC Bash =)

2010-09-15 Reply Admin

This is actually the same bug as a bug in Windows 95/98/ME.

"File and Print Sharing service in Windows 95, Windows 98, and Windows Me does not properly check the password for a file share, which allows remote attackers to bypass share access controls by sending a 1-byte password that matches the first character of the real password, aka the "Share Level Password" vulnerability."

(http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0979)

2010-09-15 Reply Admin

SR:

isecretlylikejustinbeiber

i secretly like just in beiber

what do you mean by "in beiber"?

Jaime · 2010-09-15 Reply Admin

Chris:
In some systems it actually is important to hold passwords as something other than String. Because in Java and C# String is immutable, it's rather difficult to remove the password from memory once it is no longer needed. That opens it up to attack from eg malware that scans the PC's memory (or possibly worse, swapfile). If the password is captured into a char[] instead, the array can be overwritten as soon as it is finished with.

Which is why .Net has System.Security.SecureString.

2010-09-15 Reply Admin

In fact passwords should be treated differently: you should use a constant time comparison (e.g. not returning once a mismatched character is found as in the above)

2010-09-15 Reply Admin

v:
In fact passwords _should_ be treated differently: you should use a constant time comparison (e.g. not returning once a mismatched character is found as in the above)

TRWTF is machines that would take more than a nanosecond to process two > 1,000-character passwords.

2010-09-15 Reply Admin

v:
In fact passwords _should_ be treated differently: you should use a constant time comparison (e.g. not returning once a mismatched character is found as in the above)

What kind of squirrely, hypothetical fantasy world do you live in? Any cracker that attempted to break the password this way would be confounded by the packet latency that would take place between the submit and the return. THAT ITSELF is a variable time parameter, and would completely prempt any time-based "cracking" algorithm.

2010-09-15 Reply Admin

Bob:
v:
In fact passwords _should_ be treated differently: you should use a constant time comparison (e.g. not returning once a mismatched character is found as in the above)
What kind of squirrely, hypothetical fantasy world do you live in? Any cracker that attempted to break the password this way would be confounded by the packet latency that would take place between the submit and the return. THAT ITSELF is a variable time parameter, and would completely prempt any time-based "cracking" algorithm.

Sure? http://www.itbusiness.ca/it/client/en/home/news.asp?id=58406

2010-09-15 Reply Admin

spameggs:
Bob:
v:
In fact passwords _should_ be treated differently: you should use a constant time comparison (e.g. not returning once a mismatched character is found as in the above)
What kind of squirrely, hypothetical fantasy world do you live in? Any cracker that attempted to break the password this way would be confounded by the packet latency that would take place between the submit and the return. THAT ITSELF is a variable time parameter, and would completely prempt any time-based "cracking" algorithm.

Sure? http://www.itbusiness.ca/it/client/en/home/news.asp?id=58406

That article is B.S. Fiction written to sell more software.

2010-09-15 Reply Admin

A world in which people learn about statistics, and know a tiny bit about computer security. There have been a few, well publicized timing vulnerabilities in the last few years.

danixdefcon5 · 2010-09-15 Reply Admin

I just had flashbacks of finding code like this in a particular web system. At first, I wondered why this would work, as it didn't encrypt/hash the password. Then it dawned in me...

the passwords were stored in clear text.

2010-09-15 Reply Admin

v:
A world in which people learn about statistics, and know a tiny bit about computer security. There have been a few, theorized timing vulnerabilities in the last few years.

FTFY

frits · 2010-09-15 Reply Admin

It was a joke.

Addendum (2010-09-15 12:28): You would think the whole "loop over a switch" thing would be a tip off.

2010-09-15 Reply Admin

Attacks were mounted, keys were recovered, please don't ever write security code, thanks.

2010-09-15 Reply Admin

Aceof♥s:
BG:
In TheDailyWTF comment system you can type your password in and it appears as *'s!. For instance, if you typed 'hunter2' it would appear to me as '*******'
BG♥sCoCK
Did it work?

It depends. What are you doing this Saturday?

chikinpotpi · 2010-09-15 Reply Admin

Steve H:
BG:
In TheDailyWTF comment system you can type your password in and it appears as *'s!

Weird! Where does the completely spurious apostrophe come from?

it is the manifestation of the world's dislike for you.

2010-09-15 Reply Admin

frits:
You would think the whole "loop over a switch" thing would be a tip off.

They apparently haven't heard of the for-switch paradigm (or for-case, if you prefer).

JamesQMurphy · 2010-09-15 Reply Admin

hoodaticus:
highphilosopher:
frits:
You guys laugh, but this is the exact code the CLR uses for String.Equals(), except they use a loop over a switch for optimization.

This is nothing like the code that .NET uses for String.Equals(). They call an internal unsafe method called EqualsHelper() which does a while loop over the two Char arrays to check them character by character.

Then frits is right, jackass. Or do you think there's a meaningful difference between a while loop and the implementation in the sample?

The RWTF here is not using the built-in library.

No, frits said "over a switch statement", which would be different. But he was just being cheeky.

And highphilosopher pointed out that the internal String.Equals uses unsafe code, which allows it to use pointers for performance. He may have missed the sarcasm, but there's no need to get nasty.

2010-09-15 Reply Admin

Steve H:
BG:
In TheDailyWTF comment system you can type your password in and it appears as *'s!

Weird! Where does the completely spurious apostrophe come from?

it's a contraction of **s. He means that that the password appears as pairs of stars

EvanED · 2010-09-15 Reply Admin

barc0de:
BG:
In TheDailyWTF comment system you can type your password in and it appears as *'s!. For instance, if you typed 'hunter2' it would appear to me as '*******'

Haha, very funny, do you really think i would give you my ******** that easily

LOL. That's a wonderful response to that meme; I may have to steal it.

Dave:
I've raised these issues with their support team however they state that these faults are actually features. They even said that because hundreds of people forget their passwords that they are willing to sacrifice a little security for ease of use.

Why are you still using them as a bank? (Or are you?)

Kohls only allows up to 8 characters for their credit card site, but at least distinguishes case and it allows at least some special characters. Usually I do some things that decrease the entropy over a completely random n-character password (like make it pronounceable), but with them I keep as much strength as I could figure out I could.

When it comes to banks, there are enough that I would have no compunction about closing my account and moving to another bank over that issue.

2010-09-15 Reply Admin

While I understand the need for security, I think after three tries my computer should let me in anyway. After all it is my computer, and you software geeks need to face reality and understand that I have important deals to close and I can't be bothered typing my password over and over all day long whenever I go to my bank, or stock broker, or the gaming and pr0n sites that keep me on my edge.

2010-09-15 Reply Admin

Timing Attacks are BS.

Could someone devise a test on a closed system, while in control of every aspect of the network infrastructure, with the ability to reduce as much noise as possible?

perhaps

could you utilize those techniques to crack a password at Digg.com?

no.

The complexity of filtering out the noise is exponentially higher. Heck, even the interrupt coalescing algorithm (that is likely running on the network driver on the server you are connecting to) will introduce noise orders of magnitude greater than the change in processing time from getting a character correct.

SeySayux · 2010-09-15 Reply Admin

Obviously, everyone knows that if a.length != b.length you should return false even before starting the loop.

Correct implementation of equals (for ascii):

bool equals(String lhs, String rhs) {
     if(rhs.length() != lhs.length()) return false;
     
     for(idx_t i = 0; i < lhs.length(); ++i) {
         if(rhs.at(i) != lhs.at(i)) return false;
     }
     return true;
}

Please tell me it's correct. It's correct, right?

frits · 2010-09-15 Reply Admin

SeySayux:
Obviously, everyone knows that if a.length != b.length you should return false even before starting the loop.
Correct implementation of equals (for ascii):
bool equals(String lhs, String rhs) {
     if(rhs.length() != lhs.length()) return false;
     
     for(idx_t i = 0; i < lhs.length(); ++i) {
         if(rhs.at(i) != lhs.at(i)) return false;
     }
     return true;
}
Please tell me it's correct. It's correct, right?

You can optimize and use an object comparison. If (object)rhs == (object)lhs you can go ahead and return true immediately.

2010-09-15 Reply Admin

//This should guarantee that they can't use time-based attacks to get at our passwords!
public boolean arePasswordsEqual(String pass1, String pass2)
{
  for(String possiblePassword : passwordGenerator.passwordsOfLength(pass1.length))
  {
    if(pass1.Equals(possiblePassword) && pass2.Equals(pass2))
       return true;
  }
  return false;
}

Oh, and passwordGenerator just pulls the passwords from the database table which has the password and its hash code for easy look up. That way it's Fast and Secure!

2010-09-15 Reply Admin

public static bool passwordsMatch(string pass1, string pass2) {
  // bgates : TODO - add security stuff 
  return true;
}

Very Special Strings

Leave a comment on “Very Special Strings”