Storing Plain-text Passwords

Security is a hot issue now-a-days. You get told over and over that no one will ever ask you for your password. Not your bank, not Paypal, and not even your online grocery store. This is to make sure that people won't be persuaded by phishers and other scumbags in giving them the password.

But why is it that a lot of companies and other initiatives on the Internet seem to store passwords in plain text in their databases? There is NO NEED to do this. Almost every hypertext scripting engine (ASP, PHP, Coldfusion, Perl, Ruby on Rails) supports the hashing of passwords.

COLDFUSION: <CFSET hashedPwd = HASH(password, "SHA-256") />

When a user logs in with a username and password, they are checked against the credentials in the database. The password gets hashed, and the hash is checked against the stored hash in the database. This way no one will be able to figure out the actual password (especially if a relativley strong hashing algoritme is being used like SHA-256).

If the same user forgets his/hers password you only need a mechanisme to reset the password to a random password, and communicate this with the user (by e-mail, SMS, snail-mail, or whatever) and allow the user to change this new password to one of his own at the next logon.

Another nice feature of hashing passwords is that the user can use a password with lots of printable characters (like !@#$%^&* (){{}|":;'\][/.,<>?`~), or complete sentences because these won't be stored. Only the hash (a hexadecimal string) will end up in the database. No matter how long the password/sentence is, the hash will always be a fixed length.

Maximum flexibility for the user, and a secure way of storing the passwords in the database. So if financial institutions or other high profile web-presences fail to do so, they should be made aware, and change their code.

So there's absolutely no need for anyone to be able to see your (plaintext) password besides yourself. And don't let them tell you otherwise.

FireFox 3 Color Management

In the 'old' days, Safari was probably the only Internet browser with some decent color management. The problem was that images displayed in Firefox and Internet Explorer looked a bit desaturated and lighter.

Now, in FireFox 3 you have the opportunity of enabling color management. Just set the following configuration option to 'true' (by double clicking) in the FireFox configuration settings (to access the config-part of FireFox, just type about:config in the address bar).

gfx.color_management.enabled

This feature is turned off by default. Restart firefox and be amazed by the colors in your photos on the Internet

Undocumented Coldfusion Ports

After running 'chkrootkit' on one of my Ubuntu server at work, I got a responds:

Checking `bindshell'... INFECTED (PORTS:  4000)

A message which started a 'mild' shiver across my back, because the rootkit checker just reported that one of the processes on the server could be compromised.

First I took the server of the network. Just to make sure. After that I searched the Internet for a possible explaination. Nothing substancionally. until I found the following command to see what is occupying the port.

sudo netstat -e -p -n -a | grep 4000

This gave me the following result:

udp6       0      0 :::4000                 :::*
65534      13886      4739/coldfusion8

So it seems that Adobe Coldfusion is using this port. But this can't be found in any of the official Adobe Coldfusion documentation. There are some (blog)posts related to this, but nothing more.

Update on Tuesday, April 6, 2010 at 11:04 by Willem

This 'problem'still occurs with Coldfusion 9 (on Centos 5.4)

Lucky shot

I spotted the airplane just in time. It's a KLM airplane heading south. The image is not manipulated (apart from the conversion to black&white).

More photos at my flickr page.

Point & Shoot

Ever since a certain split-up, I'm in need of a decent point&shoot camera. A nice small camera to fit in my pocket for every day snapshot use, but with pro-like features. Why?, because they won't allow you to attend a concert with a Nikon D300 and a 80-400mm lens.. (or any lens for that matter). And the camera on my Nokia N95 is not satisfactory at all.... But then again, it's a phone.

At the moment I'm kinda interested in the Canon Powershot G9, or the Panasonic Limux DMC-LX3 (which is not available yet. The first is.. well... kinda a legend at this moment, but the second is throwing high hopes for that segment. The new Nikon P6000 lacks Mac support and uses a closed RAW format at this time, so that's a no go (even though the integrated GPS in kinda neat).

Guess I have to wait for the first reviews of the Panasonic Lumic DMC-LX3. I hope it's available soon.

Brilliant Olympic Photos

Fotostrecke: Die besten Bilder der Spiele - Olympia 2008 - stern.de

Reflecting Windmills

Taken @ Kinderdijk, the Netherlands

More photos at my flickr page

Corrupt / Missing Windows Profile

If you think that things are going (relatively) well, they come right back at ya....

This time it's my laptop from work. I used to enjoy my HP NX8220 widescreen laptop. It served its purpose well over the last 3 years. Since it was out of warranty (and noisy), it had to be replaced by a Fujitsu Siemens Lifebook E8310.

Personally, I never liked the Fujitsu Lifebooks. They feel like cheap plastic laptops that might fall apart with every keystroke. Apart from the physical look and feel, there's the 'need' to use hardware which can only be used by installing a gazzilion Fujitsu installers/drivers (on the HP I only needed half the drivers to get a functioning laptop).
The quality of these drivers are questionable. On a default Windows XP Pro SP2 OS with ALL the tools/drivers recommended by Fujitsu the hardware and Windows OS don't seem to get along. Without any reason, the OS seems to hang every once in a while. And lately things have gotten worse....

Click to read more ...

Create Your Own EV Certificate??

Most web browsers support the extended validation certificates. These certificates give a visual indication (green browserbar for example) that the SSL connection is trustworthy. The only problem is that they are expensive. Especially compared with the 'ordinary' SSL certificates.

These certificates are special because the Certificate Authority (e.g. VeriSign) validated the company who buys these certificates. This way, the end user can shop / bank / or whatever online without worrying too much.

Some affiliates / certificate vendors already did this years ago (validating the actual companies), so this is nothing new. Yet another way to fool the consumers, and make some extra money.....

The problem I run into is that I used to have a 'yellow-ish' addressbar when I entered an https website. Today (at least with FireFox 3) the address bar remains blank. The only indication is a tiny lock displayed at the bottom of the browser. Something you might (and definitely will) overlook.

I use a home made Certificate Authority to create my own certificates (for webmail, secure IMAP, SSL, etc.), but I would like to see a proper visual indication of the SSL connection. So, is there a way to create an EV-like certificate (or even a new CA) by using Microsoft Certificate Services or by using OpenSSL which displayes the colored addressbar?

I did find some info on the EV requirements, but these should be 'spoofable' some way or another.....

UPDATE: I found a website which suggests reconfiguring Firefox 3. Problem with that is that I need to reconfigure all my browsers. I'd rather do it by 'faking' the specs.

It seems that the OCSP-responder is mandatory for the bars to turn green....

Wordpress 2.6.1 Fixed the Permalink Bug

The highly anticipated Wordpress version 2.6.1 is finally released. This version fixes the permalin bug I reported on earlier.

Upgrading was a piece of cake (I think). First gonna check all the plugin functionalities......