I Made Another Bank

The_King_JAZ, on 01 February 2016 - 12:21 AM said:

TERMINAL
BANK

Kronix, on 01 February 2016 - 01:05 AM said:

The_King_JAZ, on 01 February 2016 - 12:21 AM said:

TERMINAL
BANK

These pastes no longer exist.

Lupus590, on 01 February 2016 - 08:13 AM said:

Kronix, on 01 February 2016 - 01:05 AM said:

The_King_JAZ, on 01 February 2016 - 12:21 AM said:

TERMINAL
BANK

These pastes no longer exist.

@OP did they have the expiry date set to never?

Kronix, on 02 February 2016 - 01:39 AM said:

How would one go about registering an account? It doesn't appear obvious.

Creator, on 04 February 2016 - 08:00 AM said:

Maybe have the hash of the password on the disk, in order to protect it if anyone else manages to get his hands onto the disk.

Mikk809h, on 04 February 2016 - 09:52 AM said:

Creator, on 04 February 2016 - 08:00 AM said:

Maybe have the hash of the password on the disk, in order to protect it if anyone else manages to get his hands onto the disk.

Or even better; Have a salted hash be saved to the disk. that'd prevent from rainbow lookup tables etc.

The_King_JAZ, on 04 February 2016 - 05:51 PM said:

Mikk809h, on 04 February 2016 - 09:52 AM said:

Creator, on 04 February 2016 - 08:00 AM said:

Maybe have the hash of the password on the disk, in order to protect it if anyone else manages to get his hands onto the disk.

Or even better; Have a salted hash be saved to the disk. that'd prevent from rainbow lookup tables etc.

How exactly would I implement a hash or a salted hash of passwords? And I think I would probably store the password on the bank computer itself, rather than the disk. I would then change the Terminal program to still require a password for logging in to the account with a banking card. But the thing is, I would have to 1) hash the password before storing it on the Bank computer, and 2) hash the password before broadcasting it from the Terminal to the Bank. How would I do this? (I'm not very good with this kind of stuff, if you can't already tell…more of a learning experience for me, really)

The_King_JAZ, on 04 February 2016 - 05:51 PM said:

Mikk809h, on 04 February 2016 - 09:52 AM said:

Creator, on 04 February 2016 - 08:00 AM said:

Maybe have the hash of the password on the disk, in order to protect it if anyone else manages to get his hands onto the disk.

Or even better; Have a salted hash be saved to the disk. that'd prevent from rainbow lookup tables etc.

How exactly would I implement a hash or a salted hash of passwords? And I think I would probably store the password on the bank computer itself, rather than the disk. I would then change the Terminal program to still require a password for logging in to the account with a banking card. But the thing is, I would have to 1) hash the password before storing it on the Bank computer, and 2) hash the password before broadcasting it from the Terminal to the Bank. How would I do this? (I'm not very good with this kind of stuff, if you can't already tell…more of a learning experience for me, really)

-- put the sha256 code here. (Wont work with os.loadAPI)

local x="abcdefghijklmnopqrstuwvxyz1234567890/*-+.,_;:"
local function randomsalt( len )
	local str = ""
	len = len or 128
	for c = 1, len do
		local d = math.random(1,x:len())
		str = str .. x:sub(d,d)
	end
	return str
end

local random_salt = randomsalt( 128 ) --# Generate a salt of 128 characters (length)
print("New account")
write("account name:" )
local user = read()
write("account password:" )
local input = sha256.sha256(read("*") .. random_salt)

--# save the data (disk)
local handle = fs.open( "/disk/accounts/"..user, "w" )
handle.writeLine( input ) --# Hashed password here
handle.writeLine( random_salt ) --# Salt here
handle.close() --# Remember to close the handle

-- put the sha256 code here. (Wont work with os.loadAPI)

print("Login to account")
write("account name:" )
local user = read()
--# gather the salt from this user
local hash, salt
for k, v in pairs( fs.list("/disk/accounts/") ) do --# go through all accounts
    if v == user then --# if the account name matches the input then
        local x = fs.open( "/disk/accounts/" .. v, "r" )
        hash, salt = x.readLine(), x.readLine() --# get the data
        x.close()
    end
end
if not hash then
    print("Username invalid")
    return
end

write("account password:" )
local input = sha256.sha256(read("*") .. salt) --# add the known salt to the hash
if input == hash then --# validate hashes
    print("logged in")
else
    print("invalid") --# invalid hash
end

Mikk809h, on 04 February 2016 - 07:26 PM said:

I hope this explains some of your questions!

The_King_JAZ, on 04 February 2016 - 08:32 PM said:

Okay, so I messed around with it a little. Please correct me if I'm wrong. I'm just trying to understand how this works.

- Does the random salt help to further encrypt the password (being that I use "sha256(read("*")..random_salt)" )?
- And if so, is that why the random salt is required when I load it up again (using sha256(password..random_salt) to encrypt the password the same way it was when it was first entered)?
- And so I never truly decrypt the password, I just encrypt the password again under the same circumstances and match the two encryptions of the same password.

Correct?

The_King_JAZ, on 04 February 2016 - 10:40 PM said:

I need to figure out how to allow the Bank to communicate with more than one Terminal or Account Setup computer at a time.

Lupus590, on 04 February 2016 - 11:13 PM said:

Have the server give the client a token when it logs in, future transactions from the client then are prefixed with the token so that it can be identified.

Lupus590, on 04 February 2016 - 11:13 PM said:

You will have to encrypted the client server connection.

The_King_JAZ, on 05 February 2016 - 01:35 AM said:

Lupus590, on 04 February 2016 - 11:13 PM said:

Have the server give the client a token when it logs in, future transactions from the client then are prefixed with the token so that it can be identified.

How exactly do you propose that I do this? I can think of a few ways in my head that I could potentially have this work, but I'd have to test them out…

Lupus590, on 04 February 2016 - 11:13 PM said:

You will have to encrypted the client server connection.

I figured as much. It shouldn't be difficult now that I understand how to use sha256.

Lupus590, on 05 February 2016 - 10:26 AM said:

a token is something which is unique to the client and the session which can identify the user.

I'm not familiar with how it works (so someone correct me if I'm wrong)but you can do a similar thing that you would for hashing and salting passwords. Except use the username instead of the password and salt with the time that the session started. The server should store when the session started as request the user to re-log-in if the session seams stale (I.E. the client stopped communicating the the server, probably meaning that the user is away)

{
  auth_token = "[color=#000000]1af3464cb7ef46b2bc380183c87aabe5f780293bb747a0c28f96788d8ce97e93a32463df2fd324daf2ffae27f28bc8c1b078986112dbd2dddaf48e5f7ab7fa1c",[/color]
  expires = 500, --# seconds
}

local hash = "0f2389ufawn2f9p2hf3p9h" --#not an actual hash, just keyboard mashing
if hash == sha256( read() ) then
  print( "You input the correct password!" )
else
  print( "You input the wrong password!" )
end

local key = "unbreakable"
rednet.broadcast( AES.encrypt( read(), key ) )

local key = "unbreakable"
local id, msg = rednet.receive()
print( AES.decrypt( msg, key ) )

pastebin run 33PCDPv7 Tunnel

dofile = function(path,...)
local f = loadfile(path)
setfenv(f,_G)
return f(...)
end
local Tunnel = dofile("Tunnel/init.lua","Tunnel")

local Key = Tunnel.DH.connect(modem,channel)

AESKey = Tunnel.SHA.sha256(tostring(Key))

Cyphertext = Tunnel.AES.encryptBytes(AESKey,text)