Password Generation Library #3208

sarciszewski · 2014-08-27T19:54:17Z

(I'm mostly creating this PR so Travis will run the tests. Cough.)

Features:

Generate a random password

Other changes made by this PR:

Added test cases

narfbg · 2014-08-27T20:01:11Z

I suppose you haven't looked at system/core/compat/ ... :)

sarciszewski · 2014-08-27T20:03:59Z

No, I somehow didn't notice this. I suppose I should nuke the PBKDF2 parts... would this be any good as just a solid "random strings for passwords" library?

narfbg · 2014-08-27T20:09:29Z

Yea, when I mentioned a password library earlier I was thinking more of a password generator library/helper with options for different types of passwords.
If it is to be named CI_Password, it should just wrap around the password_*() functions (although I'm not a fan of that, kind of ties you to the library's specifics while the functionality stays the same).

sarciszewski · 2014-08-27T20:10:33Z

Understood. What would be a good name for it then? CI_Password_generator?

narfbg · 2014-08-27T20:11:48Z

CI_Password_generator would be according to the styleguide.

Btw, take your time ... I didn't expect to see that in just a few hours. :)

sarciszewski · 2014-08-28T03:50:41Z

Okay, the tests are passing. At this point, I'd like to open the floor for criticism, review, suggestions, etc.

I'm also considering adding public funciton diceware($words) that would generate a diceware passphrase with a given number of words (minimum 5). However, this would require storing an array with 7776 elements somewhere-- either in configuration, a text file, or in the script itself. Anyone have thoughts on how to proceed with this? (Or, should we leave it alone?)

narfbg · 2014-08-28T07:01:29Z

You need to revert all changes to CI_Security - I've fixed the ctype_digit() issue (thanks for that one) and we already have hash_equals() (system/core/compat/hash.php) for constant time comparisons.

Also needs to comply with the styleguide ... stuff like TRUE vs true, where to put opening braces, etc.

On diceware() ... no, I don't think we should store such huge arrays anywhere within CI.

I'll leave inline comments on the patch for other details.

narfbg · 2014-08-28T07:02:42Z

system/libraries/Password_generator.php

+ 		$this->security = new CI_Security();
+ 		$rules = config_item('password_rules');
+ 		if (!empty($rules)) {
+ 			$this->default_rules = $rules;


If you'll be overwriting this, it shouldn't have 'default' in its name. :)

Should also be a protected property.

sarciszewski · 2014-09-16T22:35:29Z

Uh oh, there's a merge conflict? Hmm.

ivantcholakov · 2014-12-16T23:54:18Z

Well?

sarciszewski · 2014-12-17T01:32:38Z

Squashed and resolved the merge conflict.

narfbg · 2014-12-17T17:14:06Z

system/core/Security.php

+	 * @param	string	$b	The other string being compared
+	 * @return	boolean
+	 */
+	public function compare($a, $b)


We have hash_equals() in system/core/compat/, you don't need this. :)

narfbg · 2014-12-17T17:15:48Z

You deffinately need to rework this to match our styleguide, add a changelog message and documentation.

narfbg · 2014-12-17T17:17:26Z

tests/codeigniter/libraries/Password_generator_test.php

+	public function test___construct()
+	{
+		$CI =& get_instance();
+		$this->assertTrue($CI>security instanceof CI_Security);


Oddly, this is not a syntax error, but still erroneous. :)

Edit: And, um ... this test is kind of pointless. :)

ircmaxell · 2014-12-19T15:06:46Z

@ivantcholakov I wrote a blog post recently about that topic: Educate, Don't Mediate.

I think the rationale for replicating a security critical library in you code is flawed. If you don't have the skills to maintain such a library, then you're actively doing your user base harm by including it. Instead, educate the user base on how to do it properly.

The rest of the industry has adopted the component approach, because it has nothing but advantages once you get past the initial learning curve. And that learning curve is not that difficult.

You should be helping users over that learning curve. Not telling them they don't need to learn it because you'll just provide your own alternative.

At the moment all the code is CodeIgniter's only, it is some kind of tradition from the past.

Complacency kills. Not realizing that the past was flawed, and continuing it will actively harm people.

I could care less about the project and the direction that it takes. What I care about is the users who the project will take with them. They deserve to learn the better way, not just the historical one.

The same problem is about the supported PHP version, it is too late for changes.

It was too late for changes 4 years ago when PHP 5 was EOL. That's when it should have been done.

So you say "too late for changes". I say "Better late than never".

narfbg · 2014-12-19T20:28:13Z

Boy, that escalated quickly ...

@ircmaxell So, are you -1 on this because of the minimum version requirement or because you don't believe such a library should be a framework's part instead of a stand-alone component?

I can agree with the latter.

@sarciszewski It doesn't even come close to what the CI styleguide suggests.

ivantcholakov · 2014-12-19T21:08:24Z

@ircmaxell

"Educate, Don't Mediate" - Teaching is not my business, I serve my clients. CodeIgniter is not an educational toy, it serves business, it provides solutions. For mature people education is personal investment and personal responsibility.

"If you don't have the skills to maintain such a library, then you're actively doing your user base harm by including it." - I understand every line of the proposed code. When I wrote "qualified persons", I ment a good procedure, a formality. It is good code to be re-checked, but I see that you are reluctant to do so. Thank you very much for sharing your thoughts anyway.

sarciszewski · 2014-12-19T21:55:24Z

It doesn't even come close to what the CI styleguide suggests.

Oh. Is it a whitespace issue? A capitalization issue? I don't know what I'm overlooking.

narfbg · 2014-12-19T22:01:29Z

Well, it's a lot of stuff, that's why I said it doesn't come close. :) I'll leave some inline comments ...

narfbg · 2014-12-19T22:02:05Z

system/libraries/Password_generator.php

+ 	public function __construct()
+ 	{
+ 		$rules = config_item('password_rules');
+ 		if (!empty($rules)) {


Spaces around the ! character.

We also always put curly braces on a new line.

defuse · 2014-12-19T22:15:55Z

FWIW I have a side-channel resistant PHP password generator here that you're free to draw inspiration from: https://github.com/defuse/php-passgen

ircmaxell · 2014-12-21T00:17:23Z

@narfbg The latter. The version discussion was a side-track (I still think it's incredibly important, as you can see from my recent blog post, but unrelated to this issue).

But I think fundamentally the component route is a far safer one, and strongly believe that we don't need duplicate functionality everywhere, especially in a security context.

sarciszewski · 2014-12-21T04:47:59Z

Okay, I'm going to close this PR and move the discussion towards incorporating an independent component in #3432

ivantcholakov · 2014-12-21T16:29:20Z

Personally I have no problem with this decision. But something must be done. I saw this https://github.com/bcit-ci/CodeIgniter/wiki/Random-Password-Generator

ircmaxell · 2014-12-22T20:28:43Z

@ivantcholakov completely fair. But to fix that, educate it. Fix the wiki post, educate users. Teach them. That's how you fix this in the long term...

sarciszewski · 2014-12-22T21:03:24Z

Eww, yeah. So...

Should we fall back to php-passgen by @defuse?
Is there a better alternative library to use?

ivantcholakov · 2014-12-23T01:00:48Z

@sarciszewski A long series of day-offs is comming, I feel uncomfortable to bother people.

narfbg · 2014-12-23T14:04:52Z

@sarciszewski I see nothing wrong in linking to either @defuse's or @ircmaxell's password-generating libraries.

However, I also think bundling a copy would be a mistake and I'd rather recommend them via documentation or on that wiki page.

sarciszewski · 2014-12-23T14:59:02Z

Makes sense to me.

dmyers2004 · 2014-12-23T15:09:05Z

I would rather see these as composer packages. Since CI 3 has composer support already.
I think that we should leverage that much like we where trying with sparks.
Maybe a wiki section for "codeIgniter ready" composer packages or something?
You could add a single line to composer, grab the package, and start using it in 3 minutes (if you're a slow typer and connected over 56k)

sarciszewski · 2014-12-23T15:19:23Z

"I would rather see these as composer packages."

Sure, let's just encourage more developers to pipe data retrieved over a network to a scripting language interpreter!

(I'm working on making Composer do asymmetric signature verification, but until it's ready I don't recommend using Composer.)

ircmaxell · 2014-12-23T19:43:33Z

FWIW: composer requires 5.3.2... So isn't adding composer support raising your minimum? ;-)

dmyers2004 · 2014-12-23T20:21:54Z

Good points.
Using composer with CodeIgniter 3 isn't "required" (therefore 5.3.2 isn't required) but it is already in CI 3. So perhaps a disclaimer in the manual?

http://www.codeigniter.com/userguide3/general/autoloader.html?highlight=composer

Perhaps a better approach would be to include "with composer" and "without composer" as part of your "CodeIgniter Ready" instructions? For those concerned about the security issues and/or have a version of PHP which is to old. You lose the autoloader but as long as it's 5.2.4 compatible you should still be able to attach and use it.

ivantcholakov · 2017-01-29T18:42:45Z

@sarciszewski

This password library should be published at GitHub, it is a well done job that is going to be lost. If you don't have the time, would you agree if I become a maintainer of this library under the MIT license on your name?

sarciszewski closed this Aug 27, 2014

sarciszewski reopened this Aug 27, 2014

sarciszewski changed the title ~~Password Generation and Hashing Library~~ Password Generation Library Aug 27, 2014

narfbg reviewed Aug 28, 2014
View reviewed changes

sarciszewski force-pushed the develop branch from 689bcb8 to ee86430 Compare December 17, 2014 01:32

sarciszewski force-pushed the develop branch 6 times, most recently from fd7337e to f5124cf Compare December 17, 2014 04:12

narfbg reviewed Dec 17, 2014
View reviewed changes

narfbg reviewed Dec 19, 2014
View reviewed changes

sarciszewski closed this Dec 21, 2014

Password Generation Library #3208

Password Generation Library #3208

Conversation

sarciszewski commented Aug 27, 2014

narfbg commented Aug 27, 2014

sarciszewski commented Aug 27, 2014

narfbg commented Aug 27, 2014

sarciszewski commented Aug 27, 2014

narfbg commented Aug 27, 2014

sarciszewski commented Aug 28, 2014

narfbg commented Aug 28, 2014

narfbg Aug 28, 2014

Choose a reason for hiding this comment

narfbg Aug 28, 2014

Choose a reason for hiding this comment

sarciszewski commented Sep 16, 2014

ivantcholakov commented Dec 16, 2014

sarciszewski commented Dec 17, 2014

narfbg Dec 17, 2014

Choose a reason for hiding this comment

narfbg commented Dec 17, 2014

narfbg Dec 17, 2014

Choose a reason for hiding this comment

ircmaxell commented Dec 19, 2014

narfbg commented Dec 19, 2014

ivantcholakov commented Dec 19, 2014

sarciszewski commented Dec 19, 2014

narfbg commented Dec 19, 2014

narfbg Dec 19, 2014

Choose a reason for hiding this comment

defuse commented Dec 19, 2014

ircmaxell commented Dec 21, 2014

sarciszewski commented Dec 21, 2014

ivantcholakov commented Dec 21, 2014

ircmaxell commented Dec 22, 2014

sarciszewski commented Dec 22, 2014

ivantcholakov commented Dec 23, 2014

narfbg commented Dec 23, 2014

sarciszewski commented Dec 23, 2014

dmyers2004 commented Dec 23, 2014

sarciszewski commented Dec 23, 2014

ircmaxell commented Dec 23, 2014

dmyers2004 commented Dec 23, 2014

ivantcholakov commented Jan 29, 2017