Avast and Chrome hangs

I’ve run out of NOD32 license so I’ve downloaded Avast Home/Professional version. It is friendly, fast and seems to know a lot. So I’ve installed it and I was totally happy.

After a while Chrome started crashing randomly. I couldn’t even kill chrome process, not even with Process Explorer. Restarts helped, but just for a while.

I found forums about the same symptoms with Firefox, and a few with Internet Explorer. I’ve already uninstalled Avast and I’m moving back to NOD32. Safe, fast and simply works. I will never use free antivirus software again.

International Internet censorship

I've just read that the government of UK is contacting the government of US to create an international Internet censorship system. I was really happy when I read it first. I read the whole article after that and I wasn't happy at all.
They want to create a classification system for all the sites and make the ISPs to force the classification and remove 'improper' sites and pages.

I was happy because I think there should be a strong control over the pages kids can access. There should be strong control over pages that contain illegal content. But these should be categorized by an independent judge considering laws, not a group of people with morale influences.

Let's take the most recent case with Facebook.com. They don't allow images about moms breastfeeding their babies. It's OK from their point of view and they own the web application. On the other hand there is no law against such images and there are laws in many states of the US that moms can breast-feed babies in public places. It's their choice. Imagine that some group of people in an 'Internet Censorship Board' would take the same step.

I would be happy with a system that would build up as follows:

• Sites should rate themselves (or by something like the Certificate Authorities)
• Intentional misratings should be punished somehow (by the law, blacklisting or something like that if it's needed)
• There should be applications built into the browsers or standalone versions that can filter content by these ratings

If you look at popular sites dealing with sexuality they usually mark themselves somehow. A standard is missing and I think it should be an open standard.

Silverlight authentication

If you need to access server resources from Silverlight (e.g uploading statistics, reading data from database), the easiest solution is to invoke an XML Web Service. I've seen many examples of Silverlight authentication for Web Services. Many of them are illustrated and well-written. The main problem is the security: they create the illusion of security. So if you want to create a secure authentication method, you can use the following solution to achieve a good level of security.

Log in user (either using ASP.NET or using Silverlight through an XML  Web Service).

  1: public bool Authenticate(string Username, string Password)
  2: {
  3:     if (FormsAuthentication.Authenticate(Username, Password))
  4:     {
  5:         FormsAuthentication.SetAuthCookie(Username, false);
  6:         return true;
  7:     }
  8:     return false;
  9: }

Now you can check if the user is authenticated.

  1: if (HttpContext.Current.User.Identity.IsAuthenticated)  
  2: {  
  3:     DoWork();
  4:     return true;  
  5: }  
  6: else  
  7: {  
  8:     DoNothingUserNotAuthenticated();
  9:     return false;  
 10: }  

Now there are two main security threats:

• Login is insecure
• HttpContext function is insecure

Login is insecure

You have to implement login functionality securely to make you application secure. So use SSL to prevent eavesdropping  and tempering login data.

HttpContext is insecure

ASP.NET Forms authentication uses cookies to identify users (by default). You have to encrypt the authentication ticket using the server key and decrypt that whenever you read that. Don't persist the cookie if you don't have to.

Security

The solution above can be secure. You can log on to the site. A security ticket is created with the user credentials, encrypted and stored on the user's machine. This cookie is accessible whenever user have to prove his identity, so you can access it even in an XML Web Service or through HttpContext.

Direct authentication pattern (I think) is not a solution for Silverlight Web Services, because password goes as plain text to the service every time it is invoked, or severe performance degradation occurs.

FormsAuthenticationTicket UserData disappears

I'm building an ASP.NET site and I had to implement the authentication/authorization subsystem. This is a standard code that is recommended by MSDN and several tutorials on the Web:

  1: if (loginResult == LoginResult.Successful)
  2: {
  3:   if(Request.QueryString["ReturnUrl"] != null)
  4:   {
  5:     Security.CreateAuthCookie ( this, txtUserName.Text );
  6:     FormsAuthentication.RedirectFromLoginPage ( txtUserName.Text, chkRememberMe.Checked );
  7:   }
  8:   else
  9:   {
 10:     Security.CreateAuthCookie ( this, txtUserName.Text );
 11:   }
 12: }

If username and password is correct, user can log in. If there is a return URL (this means he tries to access secured content), we have to create an authentication cookie and redirect user to that URL.  Security class and LoginResult enumerations are own implementations.

The code above will not work correctly if you are using own FormsAuthenticationTicket. Internet Explorer seems to work fine, but Firefox keeps showing the Login page. It seems there is a bug in the Framework and the UserData property (where we store e.g. roles) of the ticket will be empty (sometimes). The solution for the problem is changing line 6:

Response.Redirect( FormsAuthentication.GetRedirectUrl( this.txtUserName.Text.Trim(), false ));

Article Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication on MSDN is correct, use that for implementing own Forms authentication.

How to create salted password hash

We store user passwords in hashed format. A hash function is a one-way data alternation: we create the fingerprint of the data, and the original data can't be retrieved from it.

How to create hash

Take the following steps to create the hashed user password:

1. Get the user's password
2. Use a hash function on the plain text (original password)
3. Store the hashed password in the database for user identification

How to identify the user

Take the following steps to identify a user using her username and password:

1. Get the user's password
2. Use a hash function on the plain text (original password)
3. Read out her stored hashed password from the database. It's identified by her username.
4. Compare the two (recently generated and stored password) hashed passwords. If they are the same, you can grant access to the user.

What is salt?

Salt is a data we add to the password. This way it's much more harder to break the hash (e.g. get the hashed data).

How to create and store salted hash in C#

There are two ways we can choose:

• Create our own algorithm
• Use a library

Using an own security algorithm can be dangerous so I prefer libraries.

System.Security.Cryptography

System.Security.Cryptography in mscorlib contains several hash functions. Here is a usage example:

byte[] data = new byte[DATA_SIZE];
byte[] result;
SHA1 shaM = new SHA1Managed();
result = shaM.ComputeHash(data);

These classes provide hash functions, but they can't create salted hash without own algoritms.

Microsoft Enterprise Library Cryptography Application Block

Enterprise Library can create hashes with salt. No additional algorithms needed. Open Visual Studio.

App.config

Add App.config file to your solution if you don't have one yet. Right-click it, and select Edit Enterprise Library Configuration. If Enterprise Library is not installed on your machine, you won't see this option.

Right-click your App.config node in the tree view and click New/Cryptography Application Block. Select Hash Providers/New/HashAlgorithm Provider. Select your hash algorithm. On the Properties tab, make sure SalEnabled property is True.

Create salted hash

The following code will create a hashed password with Base64 coding. You will be able to copy the value to your database.

byte[] password = UnicodeEncoding.UTF8.GetBytes("plain text password here");
string hashedPassword = Convert.ToBase64String(Cryptographer.CreateHash("SHA512Managed", password));
            Array.Clear(password, 0, password.Length);

Check user password

You can check your salted hash agains the user's password this way:

if (Cryptographer.CompareHash("SHA512Managed", Encoding.UTF8.GetBytes("plaintext password here"), Convert.FromBase64String("password from database here")))
{
             return true;
}
else
{
             return false;
}

 

Technorati-címkék: security,hash,cryptography,password,salt,salted hash,database

Link: Hash function
Link: Salt (cryptography)
Link: SHA1Managed Class
Link: Enterprise Library