Building Password Purgatory with Cloudflare Pages and Workers | Hacker News Reader

Building Password Purgatory with Cloudflare Pages and Workers

troyhunt.com

107 pointsrobin_reala37 comments

You can find the in-progress list of checks in this source file:

https://github.com/troyhunt/password-purgatory-api/blob/mast...

It includes such gems as requiring the sum of all digits in the password to be divisible by 3, requiring passwords to contain Simpsons/Family Guy character names, emoticons, ending with “dog”, and all sorts of other craziness.

Can’t wait to see his results.

Looking at the list I think it might be possible to pass all the tests (please correct me if I'm wrong). Maybe there needs to be a catch-all test that always fails?

“Sorry, another user in our system has that password”

Sorry user X has that password. Please contact the at: <their email> to ask them to change it.

Oh wow, evil.

It lacks the most infuriating rule found in the wild, an upper limit on the length of the password (that's not at least in the thousands due to e.g. request size limits).

Assuming an random alphanumeric password and a 256 bit hash there is no benefit going above a 55 character password. Even if you aren't just using random characters I think 100 is a fine limit. Most people are not going to be using a password that long without a password manager. If they are using a password manager they might as well just use a random password.

For there to be more security in allowing passwords thousands of digits long the host would very likely being storing your password in plain text as opposed to pulling out a few thousand bytes out of an XOF (extendable output function).

I am aware that there is an upper limit on security provided by longer passwords, but websites should still not set arbitrary upper limits on length from a usability point of view. If I want to use a longer password because that's the default my manager generates, let me.

If you use a password manager you can use 4 character passwords.

[citation needed]

I think most people complaining about this on real sites are trying to use a passphrase of thirty-ish letters and spaces, and finding they can't.

passwords are not attacked with random noise, a 55 letter password of 7 common words has way less entropy that 256 random bits.

in my opinion password size should be oriented towards preventing DoS attacks, little more

(also you can prehash the password on the client with a quick non-password specific but still cryptographically strong hash and then use a proper hash server side, so that on the network all passwords are 256 bits

even worse than the sum: "Password when stripped of non-numeric characters must be a number divisible by 3", considering it needs a valid zip and three digits of pi that starts to get non-trivial!

Can't you just add an extra number?

You don’t need the bespoke Wrangler workflow now with Pages Functions [0]. Just drop the scripts in the `api/` directory in the page repo.

[0]: https://developers.cloudflare.com/pages/platform/functions/

I'm glad they're more combined now. It was annoying figuring out Pages and wrangler for web / functions respectively.

As a back-end developer, I was recently impressed by how quickly I was able to get up and running with Vercel, having started a vanilla JS project with Vite. Single change to my DNS records, and it's all setup at a custom domain in no time. If I was doing this project, I'd probably do it like that?

UPDATE: I'm procrastinating other projects. https://grou.ch (or https://passwordpurgatory.vercel.app/ if DNS hasn't propogated yet)

Times taken:

45s run vite

8m basic vanilla HTML scaffold

4.5m add some better password rules

1.75m setup in Bitbucket

1m Add to Vercel

1.5m setup custom domain

If I wanted to capture attempts, I'd probably do it via Google Analytics? It's magic to me how quick this tooling is -- just over 15m to get this up on the internet, https etc, domain, from literally nothing.

Vercel is very similar to Cloudflare Pages/Workers. I wouldn't really worry about one over the other.

Password must contain at least one tab character. Good one :)

I've never used Vercel, but skimming their site I think it's roughly the same concept as Cloudflare Pages / Functions.

SvelteKit has adapters [1] for both Cloudflare and Vercel (and Netlify), so they must be reasonably similar. I think Vite is a similar idea. I've never used it either, but have seen some references to Cloudflare deployment via a plugin.

The basic concept is really compelling IMO.

1. https://kit.svelte.dev/docs/adapters#supported-environments

I wish Cloudflare supported Python for Workers/Functions. There is some weird translation from Python to Javascript which seems extremely bloated. I just want to run Python for the backend, natively. One day, we can deploy Flask apps through Cloudflare edge nodes, that would be cool.

They only use the Chrome v8 engine to host their serverless stuff, so everything has to transpile to Javascript or compile to WASM. If v8 doesn't run it, it's not running in their edge.

I think it's a good idea; cheap runtimes and no cold start penalty are a good combination.

One of the major reasons all these kinds of services use javascript is that it can be reliably sandboxed (it needs to be, so it can run in a browser without every random website getting control of your machine). While there's nothing in theory preventing you from doing a similar thing with python, an implementation with the same hardening just doesn't exist. CPython sandboxes have been broken over and over again, to the point that conventional wisdom is "the only way to sandbox python is to run it in a VM". The only other language I can think of offhand that has similar levels of sandboxing is Lua.

How does AWS lambda work? From what I can see, it runs python natively.

https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes...

Im guessing it’s LVM based. (ie: containers)

It runs it in a micro-VM.

https://firecracker-microvm.github.io/

Maybe fly.io?

I haven’t used them, but they do containers “on the edge”.

In a similar spirit there is http://spa.mnesty.com and https://twitter.com/rescambot , the first one which is more simple and the second which has been discontinued.

Re:scam seemed quite good at what it did https://imgur.com/a/rrHi2

Does anyone know of any other service? I've had varying success with spamnesty , if I recall it does (or did) just have a list of non-answers it picked randomly from. While the Re:scam seemed to use some kind of ML to generate more relevant answers.

> it does (or did) just have a list of non-answers it picked randomly from

Yes, this is true (I made Spamnesty). Lately the scammers have mostly stopped responding and just use bots, so it's all a list of bots replying to bots, and thus much less entertaining.

I always figured those SEO spammers sent bulk emails using automated or semi-automated tools. I have my doubts they will follow through on "registering" for one person's website.

Only one way to find out!

He should've done market research to see if the spammer would've even bitten.

for forum spammers i made a super hard to read super long capcha "service" where every atempt is wrong.

How do you make sure genuine users can use the forums?

Maybe today genuine users use facebook and reddit only? /sarcasm

cloudlflare has an anti-ddos feature that makes it hard to scrap pages. This feature involves a number of http redirects, and at some stage they need to run javascript in order to get to the next step. The only fix was to scrap these pages was by means of automating the browser with selenium.

I was scrapping a big number of web pages for my project here https://github.com/mosermichael/duckduckbang Had to get the description of the sites used by duckduckgo bang operators, so i wrote my own scanning system too...

Reply on news.ycombinator.com