Comments (5)
Oh, for completeness - Motorola Droid running Cyanogen 6.1.2.
from android-pwdhash.
Hi,
Interesting issue, thanks for reporting this. I will take a look at the
issue soon, but I will be traveling for the next two weeks.
Philipp
Am 21.06.2011 16:23 schrieb "Calos" <
[email protected]>:
Hi,
First, thanks for the hash app. Seems to work well, just one issue. I use
a long password, which often results in a 20+ character hash. When
generating hashes this long, the app seems to append 4 trailing spaces,
which obviously cause logins to fail if not removed.The hash itself is correct. I do believe it has to do with the length of
the generated hash, as trying it with a shorter password does not produce
the trailing spaces.Thanks!
Reply to this email directly or view it on GitHub:
#1
from android-pwdhash.
Found the issue. This is actually a flaw in the algorithm and also present on pwdhash.com. The algorithm does under some circumstances append NULL bytes to the hash, if the hash is shorter than the input password. If you use Firefox you can even see the NULL bytes at the end of the hash on pwdhash.com, but they are ignored on copy'n'paste.
I've released version 1.2 which fixes the issue. You can download the APK here from github or from the Market. Thanks for finding this.
from android-pwdhash.
Thanks for the quick response!
Some other things that may be of interest...
As you mentioned you can see the nulls in Firefox, indicating it's an issue with the Stanford algorithm, I started playing around:
If I enter for a password 123456789012345678901234567890 or 30 "2" characters or 30 "1" characters and a couple other combinations, the trailing 4 characters in the hash are always "A" (both Chrome and Firefox). But if I take any of those and add a special to the end, the 4 "A" characters disappear... in Firefox, odd (apparently Unicode?) characters appear; in Chrome, the hash has no unusual trailing characters. Fortunately, copy'n'paste does eat the trailing Firefox nulls, as you say.
There certainly seems to be some errata in the Stanford algorithm. Unfortunately, that has to be replicated to maintain compatibility. Kind of scary, if you're dealing with a few different implementations. It looks like your app still generates compatible hashes for the cases that cause the trailing "A" characters.
I wonder, though, what implications the trailing A's have, in relation to cryptography? If nothing else, it's a signature that indicates an intercepted hash is probably generated by pwdhash. Beyond that, I imagine it's academic unless you are somehow being specifically targetted, as the work to crack the hash is a deterrent, so long as the pwdhash algorithm correctly implements MD5-HMAC.
Anyways, thanks again, both for the app and for the support!
from android-pwdhash.
Yes, I had the same thoughts about the appended "A" character.
For some background without going into too much detail: The algorithm applies extra constraints to the generated hash based on what characters are present in the original password (e.g. special characters) by adding extras characters. But if the resulting hash is shorter than the original password those extras are empty resulting in the null bytes.
Now if you don't use any special characters in your original password all non alphanumeric characters get replaced by alphanumeric characters, again based on the (empty) extras. This replaces all the null bytes with "A".
I don't know enough too judge the implications on the cryptographic security, but it's obvious that the algorithm does not deal well with long passwords.
from android-pwdhash.
Related Issues (13)
- Feature Request: Password options HOT 3
- Implement pwdhash as a keyboard HOT 4
- Add PwdHash to F-Droid HOT 4
- Implementing user-defined salt to address pwdhash vulnerabilities
- The app disappeared from the Play Store, can we return it back
- I've not an idea about the feasability of this, but adding sha1 hmac would be nice HOT 3
- Auto-correct messes the hash HOT 3
- Support Android data backup API
- Ocassional crash on copy to clipboard on Android 4.3 HOT 1
- Crashes when opened from Appsi (apps plugin) HOT 7
- App adds an additional character at the end of the hash HOT 6
- Add an initial seed HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from android-pwdhash.