• Toolz
  • #! Die-hard
  • Offline
  • From: Asia
  • Registered: 2009-02-02
  • Posts: 934

Re: Forum modifications: brute force protection

Tunafish wrote:

I guess using Iceweasel makes us all easier to identify... Best way is to use windows & internet explorer i guess.

No, Firefox. And using Windows isn't as anonymizing as you might think:

It's also surprising that platforms like Firefox and Ubuntu, which have lower market penetration, are on average comparable or even less identifying than Windows and Microsoft Internet Explorer, which have very large userbases and should therefore have larger crowds to hide in.

  • mzsade
  • #! CrunchBanger
  • Offline
  • Registered: 2009-09-27
  • Posts: 212

Re: Forum modifications: brute force protection

"It's also surprising that platforms like Firefox and Ubuntu, which have lower market penetration, are on average comparable or even less identifying than Windows and Microsoft Internet Explorer, which have very large userbases and should therefore have larger crowds to hide in."
"

Time for a conspiracy theory?

PS: problem in forum, cannot include smileys or quotes.

Last edited by mzsade (2010-04-04 15:44:24)

  • From: here
  • Registered: 2010-01-15
  • Posts: 187

Re: Forum modifications: brute force protection

mzsade wrote:

Time for a conspiracy theory?

Count me in! smile

.signature
  • Toolz
  • #! Die-hard
  • Offline
  • From: Asia
  • Registered: 2009-02-02
  • Posts: 934

Re: Forum modifications: brute force protection

mzsade wrote:

PS: problem in forum, cannot include smileys or quotes.

Cos you just disabled your javascript when you were playing with Panopticlick.

  • mzsade
  • #! CrunchBanger
  • Offline
  • Registered: 2009-09-27
  • Posts: 212

Re: Forum modifications: brute force protection

Oops!:) Thanks

  • Registered: 2009-01-07
  • Posts: 272

Re: Forum modifications: brute force protection

Tunafish wrote:

I guess using Iceweasel makes us all easier to identify... Best way is to use windows & internet explorer i guess.

You can try using the FF Better Privacy add-on.

https://addons.mozilla.org/en-US/firefox/addon/6623

Sheng-Chieh

Tux's Links
http://shengchieh.50webs.com/tuxslinks.html
  • From: Jakarta, or somewhere else
  • Registered: 2009-03-17
  • Posts: 189

Re: Forum modifications: brute force protection

richs-lxh wrote:

My suggestion is a minimum of 10 letters/numbers with both uppercase and lowercase which contain no words whatsoever. Just random letters and digits. Then you can create 12 passwords like this and rotate them once a month. You get a years worth for free smile

so to remember them, I'll just write them on this post-it note on my desk...??? I don't see how my security is enhanced by using passwords that I can't keep in my head.

Using an algorithm makes more sense - my take is in this Password security blog post.

I also really like Zwopper's idea of shifting the password periodically, e.g left or right.


shengchieh wrote:

If you want something quick, but easy to remember, have a password like asdf;lkj
...
1234 is too easy.  But 12340987 is not and that took me less than 1/4 seconds.

In case anyone takes this seriously - please don't. It's better than "password" or "god" or your gf's or bf's name (if their name is sally or john) but not by much.

Edit: fixed link - thanks gsmanners.

Last edited by Chriswaterguy (2010-04-05 07:26:35)

Learning Linux slowly because I'm busy with Appropedia

Chriswaterguy's Website

  • From: Jakarta, or somewhere else
  • Registered: 2009-03-17
  • Posts: 189

Re: Forum modifications: brute force protection

GuruX wrote:

How about a recaptcha on the login? Doesn't that make the forum a little more secure aswell?

How about recaptcha on the relogin? So it won't bother regular users who know their passwords, but will make it tougher for brute force attacks.

Learning Linux slowly because I'm busy with Appropedia

Chriswaterguy's Website

  • Registered: 2010-03-29
  • Posts: 39

Re: Forum modifications: brute force protection

Chriswaterguy wrote:

Using an algorithm makes more sense - my take is in this Password security blog post.

Your link is 404'd.

Kb: drivemaker's kilobyte, currently 908 bytes (shrinks by 4 bytes each year for marketing reasons)
  • From: Jakarta, or somewhere else
  • Registered: 2009-03-17
  • Posts: 189

Re: Forum modifications: brute force protection

gsmanners wrote:

Your link is 404'd.

Thanks - I had a space at the end, within the url BBcode.

Learning Linux slowly because I'm busy with Appropedia

Chriswaterguy's Website

  • Registered: 2010-01-26
  • Posts: 275

Re: Forum modifications: brute force protection

Your browser fingerprint appears to be unique among the 781,781 tested so far.

Currently, we estimate that your browser has a fingerprint that conveys at least 19.58 bits of identifying information.

I'm unique.. sounds bad neutral

I'm actually very bad with passwords, most of the time I use not-many-letters passwords and only a few good ones for e-mail etc..

Meh. Interested for a Dropbox alternative? Go to https://launchpad.net/tart
  • From: the Netherlands
  • Registered: 2010-03-07
  • Posts: 812

Re: Forum modifications: brute force protection

Andreas wrote:

I'm unique.. sounds bad neutral

big_smile being unique doesn't sound bad in real life! smile

Last edited by Tunafish (2010-04-05 17:51:15)

Compaq Presario A900 - #! Statler Alpha2 Openbox
Privacy & Security on #! - Application List
  • Registered: 2009-10-09
  • Posts: 419

Re: Forum modifications: brute force protection

Came across an article that made me think of this thread:

http://www.boston.com/bostonglobe/ideas … _password/

*heavy sigh*

  • mzsade
  • #! CrunchBanger
  • Offline
  • Registered: 2009-09-27
  • Posts: 212

Re: Forum modifications: brute force protection

Although i couldn't follow all the technical stuff here about SSL, etc. this article, along with your link--a hacker's perspective--would have had me sighing even more heavily if i had an Online Banking account, lol It did rid me of the naive thumb rule, though, that https is secure and http is insecure.

http://docs.google.com/viewer?a=v&q … IuLFAN9QpA

Last edited by mzsade (2010-04-15 01:09:36)

  • Toolz
  • #! Die-hard
  • Offline
  • From: Asia
  • Registered: 2009-02-02
  • Posts: 934

Re: Forum modifications: brute force protection

I think the (enforced) changing of passwords is a good idea in the corporate world. A few years ago we were having such problems that we made the accountants change their passwords every month. It's also good practice in light of the problems these forums have experienced, especially for m* ... oh i'm not allowed to use the m word.

Also very advisable if you've recently logged in over unsecure wifi. Not sure why https login isn't implemented ... there's a shedload of computing power on that server. Is it the cost of a cert? How about a self-signed? What kind of messages do the major browsers put up for self-signed certs these days? Are they prohibitively scary?

  • From: Lincoln, UK
  • Registered: 2008-11-20
  • Posts: 4,246

Re: Forum modifications: brute force protection

Toolz wrote:

Also very advisable if you've recently logged in over unsecure wifi. Not sure why https login isn't implemented ... there's a shedload of computing power on that server. Is it the cost of a cert? How about a self-signed? What kind of messages do the major browsers put up for self-signed certs these days? Are they prohibitively scary?

I have not looked into it, so I am not sure about the cost. I should think about doing this, thanks. smile

Regarding self-signed certificates and browser warning messages, I do not think they would be prohibitively scary to an experienced user, but I think it would definitely be quite off putting to users with less experience. If we are to go down this route, I think a valid certificate would have to be used.

Thank you again for raising this. smile

My website | Follow me on Twitter | CrunchBang on DistroWatch

corenominal's Website

  • Registered: 2009-10-09
  • Posts: 419

Re: Forum modifications: brute force protection

mzsade wrote:

Although i couldn't follow all the technical stuff here about SSL, etc. this article, along with your link--a hacker's perspective--would have had me sighing even more heavily if i had an Online Banking account, lol It did rid me of the naive thumb rule, though, that https is secure and http is insecure.

...

That was interesting. It looks like a fairly sophisticated man in the middle attack that most people probably won't run into unless they're unlucky, but it brought up a good point about details (like the lock icon) that set an expected comfort level by visual cue and the effect of what happens when it's missing. And yeah, mixing it by having it both on an unsecure page (design) and secure mode (status) creates confusion, and confusing things in general seem to be ignored or reconciled and accepted. Sorta like what I just now wrote here. big_smile

Toolz wrote:

I think the (enforced) changing of passwords is a good idea in the corporate world. A few years ago we were having such problems that we made the accountants change their passwords every month...

This. Totally. It's funny how many people will protect their workplace keycards, but when it comes to good passwords (which is part of their job to have) people balk. And I don't know how many times I pulled a post-it off note off someone's monitor that had their password on it.


----------------------

In general though safety wise, I still think plain old social engineering is probably still one of the easiest ways for someone up to no good to find out stuff.

Last edited by chillicampari (2010-04-16 18:17:22)

  • From: California
  • Registered: 2010-01-02
  • Posts: 85

Re: Forum modifications: brute force protection

I think it's cool that you're advancing web forum security.

Has anyone thought of using one of those online identity, universal login credentials?  Could one of them be considered secure?

I changed my pwd a month ago, and it took about 6 hours to do it across all the sites I visit.  Much too much work.

  • From: Cape Town, SA
  • Registered: 2009-03-18
  • Posts: 48

Re: Forum modifications: brute force protection

I don't have any suggestions on what to do - but 3 cheers for all the effort!! You're helping to make our #! world, well, better smile

No-one can possibly disagree!!

Cheers,

A day without chilies is a day wasted
  • From: The Chatsubo
  • Registered: 2010-04-03
  • Posts: 778

Re: Forum modifications: brute force protection

I would highly recommend KeePassX (it's in the repos):

KeePassX is an application for people with extremly high demands on secure personal data management. It has a light interface, is cross platform and published under the terms of the GNU General Public License.

KeePassX saves many different information e.g. user names, passwords, urls, attachments and comments in one single database. For a better management user-defined titles and icons can be specified for each single entry. Furthermore the entries are sorted in groups, which are customizable as well. The integrated search function allows to search in a single group or the complete database.

KeePassX offers a little utility for secure password generation. The password generator is very customizable, fast and easy to use. Especially someone who generates passwords frequently will appreciate this feature.

The complete database is always encrypted either with AES (alias Rijndael) or Twofish encryption algorithm using a 256 bit key. Therefore the saved information can be considered as quite safe.

Store your KeePassX database in a Dropbox folder and you can sync it across as many machines/locations as you wish.

Last edited by safetycopy (2010-11-22 22:08:25)

"Stranger, if you passing meet me and desire to speak to me, why should you not speak to me? And why should I not speak to you?" Walt Whitman, 'To You'.

46 Reply by ~HP

  • ~HP
  • #! CrunchBanger
  • Offline
  • From: Elsaß (fr_FR)
  • Registered: 2010-01-01
  • Posts: 174

Re: Forum modifications: brute force protection

IgorP wrote:

I've just remembered 1234 smile

81dc9bdb52d04dc20036dbd8313ed055

really impressive… but a little more efficient… or

MTIzNAo=

in fact: simple variations based on 1234…

~HP's Website

  • Registered: 2010-01-26
  • Posts: 50

Re: Forum modifications: brute force protection

benj1 wrote:

@ richs-lxh

enforcing password security is all well and good until every website needs a diferent password, then you need to write them all down.
At college we had to have passwords with upper case, lower case numbers etc, to make matters worse we had to change passwords every month, and couldn't reuse them either, i think in the end i just went for my name and a number, not very secure.

I use Password Gorilla to keep track of, generate and use passwords. Maybe that program will be of use to you.

rippin

48 Reply by hhh

  • hhh
  • #! Die-hard
  • Offline
  • Registered: 2010-08-04
  • Posts: 755

Re: Forum modifications: brute force protection

corenominal wrote:

If a user fails to login 5 times in any 24 hour period, the IP address will be blocked for the remainder of that day.

Because this thread was dormant for a few months, I missed the original post. I just read it and wondered why I would have to login 5 times every day!

"If a user's login attempt fails 5 times in any 24 hour period..." FTFY :^)

  • From: Athens, Greece
  • Registered: 2009-10-22
  • Posts: 600

Re: Forum modifications: brute force protection

hhh wrote:
corenominal wrote:

If a user fails to login 5 times in any 24 hour period, the IP address will be blocked for the remainder of that day.

Because this thread was dormant for a few months, I missed the original post. I just read it and wondered why I would have to login 5 times every day!

"If a user's login attempt fails 5 times in any 24 hour period..." FTFY :^)


Just think that someone else who doesn't know your password is attempting to log in to your account by giving random passwords. At his fifth attempt his ip is going to be blocked and he can't continue for the next 24h.

I think 5 attempts is a reasonable amount of times for someone who knows HIS OWN password, but instantly forgotten or given another site's password, to "get his senses" and give the correct one.

EDIT: Whoops! my appologies as well for misunderstanding the object of your post. :shy:

Last edited by slapfish (2010-11-26 13:10:01)

  • From: Lincoln, UK
  • Registered: 2008-11-20
  • Posts: 4,246

Re: Forum modifications: brute force protection

hhh wrote:
corenominal wrote:

If a user fails to login 5 times in any 24 hour period, the IP address will be blocked for the remainder of that day.

Because this thread was dormant for a few months, I missed the original post. I just read it and wondered why I would have to login 5 times every day!

"If a user's login attempt fails 5 times in any 24 hour period..." FTFY :^)

Apologies for the poor use of English. Updated as suggested. smile

Note to self, I really must update the redirect. Currently, blocked users are redirected the site's homepage without an explanation. This needs fixing.

My website | Follow me on Twitter | CrunchBang on DistroWatch

corenominal's Website