Passwords

cross-posted from: https://infosec.pub/post/10262373

Question for people willing to visit Cloudflare sites:

How do you determine whether to trust a login page on a CF site? A sloppy or naïve admin would simply take the basic steps to putting their site on Cloudflare, in which case the authentication traffic traverses CF. Diligent admins setup a separate non-CF host for authentication.

Doing a view-source on the login page and inspecting the code seems like a lot of effort. The source for the lemmy.world login page is not humanly readable. It looks as if they obfuscated the URLs to make them less readable. Is there a reasonably convenient way to check where the creds go? Do you supply bogus login info and then check the httpput headers?

eff.org/what-is-a-passkey

via @eff

I think passwords are great what do you think?

#!/bin/bash

# Generate a purely whitespace password with 128 bits of symmetric security.
#
# Characters are strictly non-control, non-graphical spaces/blanks. Both
# nonzero- and zero-width characters are used. Two characters are technically
# vertical characters, but aren't interpreted as such in the shell. They are
# "\u2028" and "\u2029". You might need a font with good Unicode support to
# prevent some of these characters creating tofu.

rng() {
    # Cryptographically secure RNG
    local min=$((2 ** 32 % 30)) # 30 = size of $s below
    local r=$SRANDOM
    while [ "$r" -lt "$min" ]; do r=$SRANDOM; done # Modulo with rejection
    echo "$(($r % 30))"
}

s=(
    # Non-zero width characters
    "\u0009" # Character tabulation
    "\u0020" # Space
    "\u00A0" # Non-breaking space
    "\u2000" # En quad
    "\u2001" # Em quad
    "\u2002" # En space
    "\u2003" # Em space
    "\u2004" # Three-per-em space
    "\u2005" # Four-per-em space
    "\u2006" # Six-per-em space
    "\u2007" # Figure space
    "\u2008" # Punctuation space
    "\u2009" # Thin space
    "\u200A" # Hair space
    "\u2028" # Line separator
    "\u2029" # Paragraph separator
    "\u202F" # Narrow no-break space
    "\u205F" # Medium mathematical space
    "\u2800" # Braille pattern blank
    "\u3000" # Ideographic space
    "\u3164" # Hangul filler
    "\uFFA0" # Halfwidth hangul filler
    # Zero width characters
    "\u115F" # Hangul choseong filler
    "\u1160" # Hangul jungseong filler
    "\u180E" # Mongolian vowel separator
    "\u200B" # Zero width space
    "\u200C" # Zero width non-joiner
    "\u200D" # Zero width joiner
    "\u2060" # Word joiner
    "\uFEFF" # Zero width non-breaking space
)
p=""

# Generate 27 characters for at least 128 bits security
for i in {1..27}; do
    r=$(rng)
    c=${s[$r]}
    p="${p}${c}"
done

tabs -1 # Tab width of 1 space

# Wrap the password in braille pattern blanks for correctly handling zero-width
# characters and to prevent whitespace stripping by the auth form.
echo -e "\"\u2800${p}\u2800\""

Example:

$ bash whitespace.bash
"⠀        ᅠ        ⠀　 ᅟ ᅠ​⠀"