Authentication Vulnerabilities in OpenBSD

Re:Authentication Vulnerabilities in OpenBSD by akira2501 on Wednesday December 04, 2019 @05:30PM (#21707928)

That's why I like DBJs method. You still use a command line program, but you pass a filehandle that the authentication data can be read from.. this seems much safer than trying to parse and re-format that data as an intermediary. Also avoids any data leaks through the often unprotected 'cmdline'.

Is there some technical reason OpenBSD doesn't do this?

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by jstewartmobile on Wednesday December 04, 2019 @07:12PM (#21708608)

Thank God for DJB. His entire website should be required reading for software developers.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by TheAceOfHearts on Thursday December 05, 2019 @05:04PM (#21717131)

Thanks for the recommendation, I'd previously heard of DJB but was unaware of his writings.

Here's the link to his website: https://cr.yp.to/djb.html

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by skunkpocalypse on Wednesday December 04, 2019 @09:55PM (#21709588)

I am convinced that DJB is actually the reincarnation of John von Neumann.

Seriously, how many other people make contributions in areas ranging all the way from number theory to hand-written machine code?

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by mjevans on Wednesday December 04, 2019 @06:17PM (#21708238)

Probably historic compatibility. If making a breaking change this might be a good time to implement a design benefiting from decades of real world experiences.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by anthk on Wednesday December 04, 2019 @07:31PM (#21708764)

That's literally what OpenBSD was doing over decades,

starting with binary compatibility

with Linux and a lot of legacy stuff

which came from NetBSD and BSD 4.4 lite/BSD 4.3.

You described OpenBSD with that comment.

- Xenocara with rootless privileges as a fork of X

- LibreSSL

- Linux compat going away

- Pledge/Unveil

- Some daemons belonging to ports

- HTTPD/SMTPD and so on as replacement of bloated daemons

- OpenSSH itself

- Retguard

This vulnerability is bad, but pledge

and unveil will have even

more prominent roles in base soon, so even

if you get privs, you can do either nil or just crash because of pledge.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by pnako on Thursday December 05, 2019 @12:14AM (#21710153)

Hu? Those vulnerabilities are authentication bypass and local privilege escalation; sandboxing like pledge is not going to help you at all there.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by anthk on Thursday December 05, 2019 @01:56AM (#21710484)

He was talking on innovation vs legacy cruft.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by k_sze on Wednesday December 04, 2019 @07:06PM (#21708550)

What does “DBJ” stand for?

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by inferiorhuman on Wednesday December 04, 2019 @07:11PM (#21708600)

Daniel Bernstein, author of qmail, djbdns, and daemontools among others.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by k_sze on Wednesday December 04, 2019 @08:53PM (#21709274)

And where does that auth-info-via-file-handle come from? I did a bit of duckduckgoing and couldn’t spot anything about that.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by simtel20 on Wednesday December 04, 2019 @11:18PM (#21709946)

The qmail source code has this convention.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by k_sze on Thursday December 05, 2019 @12:14AM (#21710155)

Thanks!

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by zdw on Thursday December 05, 2019 @09:44AM (#21712602)

Some call the concept "Bernstein Chaining": http://www.catb.org/%7Eesr/writings/taoup/html/ch06s06.html

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by kick on Wednesday December 04, 2019 @08:07PM (#21709008)

That's DJB. DBJs is a Javascript database thing. There is possible ambiguity here.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by inferiorhuman on Thursday December 05, 2019 @12:30AM (#21710202)

Fair point. I associate DJB with security and coding best practices, Javascript not so much. I can only hope the comment I replied to meant DJB the person.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by kick on Thursday December 05, 2019 @12:52AM (#21710274)

I hope so too.

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by pnako on Wednesday December 04, 2019 @10:07PM (#21709635)

DJ Bernstein, famous for remixing sendmail and similar hits in the 90s

[ Parent | on HN ]

Re:Authentication Vulnerabilities in OpenBSD by gautamcgoel on Wednesday December 04, 2019 @07:09PM (#21708581)

I think he means Daniel Bernstein, a prominent cryptographer and coder.

[ Parent | on HN ]