Password Security - Revision history

Russell: Changed protection level for "Password Security": No need to move the page ([Edit=⧼protect-level-staff⧽] (indefinite) [Move=Allow only administrators] (indefinite))

2021-01-11T18:24:08Z

Changed protection level for "Password Security": No need to move the page ([Edit=⧼protect-level-staff⧽] (indefinite) [Move=Allow only administrators] (indefinite))

Russell: Protected "Password Security": Important Information: Staff should be able to add/edit things here if necessary ([Edit=⧼protect-level-staff⧽] (indefinite) [Move=⧼protect-level-staff⧽] (indefinite))

2021-01-11T18:10:33Z

Protected "Password Security": Important Information: Staff should be able to add/edit things here if necessary ([Edit=⧼protect-level-staff⧽] (indefinite) [Move=⧼protect-level-staff⧽] (indefinite))

Russell: /* PHP */ Missed a bit

2020-07-11T21:14:05Z

PHP: Missed a bit

Russell: /* PHP */ Its late... a slight fix

2020-07-11T20:40:45Z

PHP: Its late... a slight fix

Russell: /* PHP */ Fix Link

2020-07-11T20:31:53Z

PHP: Fix Link

Russell: /* PHP */ Better Example using API

2020-07-11T20:28:53Z

PHP: Better Example using API

Russell: /* Examples */

2020-07-11T17:11:04Z

Examples

Russell: /* Examples */ Fix identation

2020-07-11T14:18:15Z

Examples: Fix identation

Russell: Add a bit more information

2020-07-11T14:08:33Z

Add a bit more information

Russell: A bit about how we can use password hashes for the great good

2020-07-11T13:55:03Z

A bit about how we can use password hashes for the great good

New page

BNC4FREE as a service stores and retains password hashes and understands how important it is to keep passwords safe and secure. This document outlines recommendations for users when setting passwords and also how we store them and ensure they cannot be decrypted.

== General Password Security ==

Your password for your account should be secure. We recommend the following:
* Use atleast one or more upper case letters
* Use atleast one or more lower case letters
* Use atleast one or more numbers
* Use atleast one or more symbols (!"£$%^&* etc...)
* '''DON'T''' keep the default the password that we email you (because if someone hacks your email, they'll find it)

== How we store passwords ==

Our software is based on ZNC which encrypts users passwords into SHA256 using a random salt. This is how it looks in the configuration:

<Pass password>
Hash = c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431
Method = SHA256
Salt = _p,7G4::X1pqh_.Y7O(U
</Pass>

Because of the way this is encrypted and salted it is impossible for us to decrypt the password.

== How we can use this information ==

We can use your password hash and salt to allow you to login to our website and wiki. It should be emphasized that we '''don't''' know your password. By knowing the password hash and its salt we are able to verify that the password you enter is correct. What this means (in a nutshell) is that when you enter your password into the password field and its submitted, we encrypt it with the salt from ZNC and if the hash matches, it is a successful login.

== Examples ==

We are able to query ZNC for the password hash and salt to authenticate users. Below are examples of how sha256 along with the hash and salt provided from ZNC can be used to verify whether the password is correct.

The below Python 2 script demonstrates how we can determine a successful login

import sys
import uuid
import hashlib
_hashedText, salt = ("c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431", "_p,7G4::X1pqh_.Y7O(U")
hashedTexti = hashlib.sha256("ThisIsSparta".encode() + salt).hexdigest()
print "Match From Text: (ZNC Hash: " + _hashedText + " --> HashLib Hash: " + hashedTexti + ")"

The result we get is as follows:
ZNC Hash: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431 --> HashLib Hash: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431

Here is a PHP example of the same

<?php
$salt = "_p,7G4::X1pqh_.Y7O(U";
$pw = "ThisIsSparta";
echo "Expected: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431\r\n";
echo "Returned: ".hash('sha256', $pw.$salt);
?>

The result we get here is:
Expected: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431
Returned: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431

@@ Line 81: / Line 81: @@
   $APIResult = file_get_contents('<nowiki>https://api.bnc4free.com/user/info</nowiki>', false, $HTTPContext);
   $APIResult = json_decode($APIResult, true);
   $api_hash = $APIResult[$Username]['password']['hash'];
   $api_salt = $APIResult[$Username]['password']['salt'];
-  echo "Expected Hash: ".$ExpectedHash."\r\n";
+  echo "Expected Hash: ".$APIResult[$Username]['password']['hash']."\r\n";
   echo "Hash from API: ".hash('sha256', $Password.$api_salt);
   ?>

@@ Line 66: / Line 66: @@
   $Username = "TestMe";
   $Password = "TestMe";
-  $APIVars = http_build_query(Array('username' => 'TestMe', 'server' => 'Staging', 'key' => 'a83e9244173a05a041586e47f36d555d87b587467d535bccd57184eb17d81bf7'));
+  $APIVars = http_build_query(Array('username' => $Username, 'server' => 'Staging', 'key' => 'a83e9244173a05a041586e47f36d555d87b587467d535bccd57184eb17d81bf7'));
   $HTTPOpts = array('http' =>
      array(

@@ Line 79: / Line 79: @@
   );
   $HTTPContext  = stream_context_create($HTTPOpts);
-  $APIResult = file_get_contents('https://api.bnc4free.com/user/info', false, $HTTPContext);
+  $APIResult = file_get_contents('<nowiki>https://api.bnc4free.com/user/info</nowiki>', false, $HTTPContext);
   $APIResult = json_decode($APIResult, true);
   $ExpectedHash = "22a61bc477465fef04548c31416b34962ee55e371627ef2007f58a6a08327c7f";

@@ Line 63: / Line 63: @@
   <?php
-  $salt = "I_I/zCQ,mWmr-trTaNKK";
+ // This will be the password submitted via a form that we never get to see or log... the rest is handled by the API and SHA256
-  $pw = "ThisIsSparta";
+  $Username = "TestMe";
-  echo "Expected: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20\r\n";
+ $Password = "TestMe";
-  echo "Returned: ".hash('sha256', $pw.$salt);
+ $APIVars = http_build_query(Array('username' => 'TestMe', 'server' => 'Staging', 'key' => 'a83e9244173a05a041586e47f36d555d87b587467d535bccd57184eb17d81bf7'));
   ?>
 The result we get here is:
-  Expected: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20
+  Expected Hash: 22a61bc477465fef04548c31416b34962ee55e371627ef2007f58a6a08327c7f
-  Returned: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20
+  Hash from API: 22a61bc477465fef04548c31416b34962ee55e371627ef2007f58a6a08327c7f

@@ Line 46: / Line 46: @@
 The below Python 2 script demonstrates how we can determine a successful login
@@ Line 58: / Line 59: @@
   ZNC Hash: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20 --> HashLib Hash: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20
-Here is a PHP example of the same
+=== PHP ===
   <?php

← Older revision	Revision as of 18:24, 11 January 2021
(No difference)

← Older revision	Revision as of 18:10, 11 January 2021
(No difference)

@@ Line 36: / Line 36: @@
      "MyUsername" : {
                           ..other info...
-                            "password" : {
+                         "password" : {
                              "salt" : "I_I/zCQ,mWmr-trTaNKK",
                              "hash" : "69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20",

@@ Line 15: / Line 15: @@
   <Pass password>
-        Hash = c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431
+        Hash = 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20
         Method = SHA256
-        Salt = _p,7G4::X1pqh_.Y7O(U
+        Salt = I_I/zCQ,mWmr-trTaNKK
   </Pass>
@@ Line 29: / Line 29: @@
 We are able to query ZNC for the password hash and salt to authenticate users. Below are examples of how sha256 along with the hash and salt provided from ZNC can be used to verify whether the password is correct.
 The below Python 2 script demonstrates how we can determine a successful login
@@ Line 35: / Line 51: @@
   import uuid
   import hashlib
-  _hashedText, salt = ("c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431", "_p,7G4::X1pqh_.Y7O(U")
+  _hashedText, salt = ("69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20", "I_I/zCQ,mWmr-trTaNKK")
   hashedTexti = hashlib.sha256("ThisIsSparta".encode() + salt).hexdigest()
   print "Match From Text: (ZNC Hash: " + _hashedText + " --> HashLib Hash: " + hashedTexti + ")"
 The result we get is as follows:
-  ZNC Hash: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431 --> HashLib Hash: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431
+  ZNC Hash: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20 --> HashLib Hash: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20
 Here is a PHP example of the same
   <?php
-  $salt = "_p,7G4::X1pqh_.Y7O(U";
+  $salt = "I_I/zCQ,mWmr-trTaNKK";
   $pw = "ThisIsSparta";
-  echo "Expected: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431\r\n";
+  echo "Expected: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20\r\n";
   echo "Returned: ".hash('sha256', $pw.$salt);
   ?>
 The result we get here is:
-  Expected: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431
+  Expected: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20
-  Returned: c124573b72475cc57c50d6111da148e79e22a4ba744587d9c0d04d1b49db6431
+  Returned: 69d186dc7a809157f98f3593c66148331eb57d59de34b40b24716e095c7acd20