[Proof of Concept] Passwordless login (Similar to the linux system)

No idea if this has been done before, but I was inspired by a Ask a Pro question and the linux system, but anyway, here's how it works:

There's a client and a server.

In order to login, the client needs to use a automatically generated key and a username to log in the first time.
After the first login, is successful, the user will never have to use their key/username again. Ever.
The user is bound the the computer ID, meaning that if ID 21 logged in with the correct key, then computer ID 21 will be the only computer to log in with that username, unless you generate a second key for the same user.

To generate a key, all you need to do is go to the server PC and type in authKey createKey <username> and it'll print your key for you. I couldn't figure out how to get rid of the extra .0 on the end of a key when written to a file, so I just kept it and added it onto the key when printed.

The user then needs to enter authKey <username> <key> where key is the key printed by the server.

So here's an example of what I might do:

Admin: authKey createKey myUser
Admin: [enter password]
Console: Your key is: 197853.0
Admin: authKey startListener
Admin: [enter password]

User: authKey myUser 197853.0
Console: Server says: Success

From that point on, the user never has to enter a username or password. They can just use authKey with no arguments to log straight back in.

Admin being the person to handle the server side stuff, and User being the client side.

The server is also password protected. The first time you run, it will ask for a password. If you want to change the password, you can use authKey changePass then enter your old password, and then your new password.

Unfortunately you can't run both the listener and create users at the same time, but I think I can fix that by either setting up 3 PCs (One listener, one for admins to add users, and one to store all the data. Last one can also be a drive.)

This is all proof of concept stuff, there's nothing special about the script after login.
Admin: [enter password]

Codes:
I had a go at making an installer, too. Here's the code:


Installer:
https://pastebin.com/hFF5a9DC
pastebin get hFF5a9DC authKeyInstaller

Client:
https://pastebin.com/GRCmhBiE
pastebin get GRCmhBiE authKey

Server:
https://pastebin.com/pyFU8aQx
pastebin get pyFU8aQx authKey

I've only been using Lua for a few days now, so lemme know what ya think :D/>

Neat! One issue which stands out is that computer IDs are very easy to "spoof", meaning you can pretend to be someone else's computer and therefor log in as them. An alternative solution would be to generate a new key on the initial setup, and use that for connecting instead.

Another thing you should probably be aware of is that rednet is very easy to listen in on. You might want to look into some form of encryption between the client and server - it doesn't have to be super advanced, just good enough to keep the average user out.

SquidDev, on 13 May 2017 - 08:44 AM said:

Neat! One issue which stands out is that computer IDs are very easy to "spoof", meaning you can pretend to be someone else's computer and therefor log in as them. An alternative solution would be to generate a new key on the initial setup, and use that for connecting instead.

Another thing you should probably be aware of is that rednet is very easy to listen in on. You might want to look into some form of encryption between the client and server - it doesn't have to be super advanced, just good enough to keep the average user out.

I actually had no idea of either of these.. I'll do some research and maybe try to prevent spoofing. I did add a bit on the client side that warns you when the server that sent you a message has a different ID to the server you sent the info to.

Broken: https://pastebin.com/UFYYjVvK

Side note: you can't prevent spoofing. Try to implement some kind of authentication (maybethrough encryption). Check out @SquidDev's AES API and @Anavrin's

Restioson, on 13 May 2017 - 09:49 AM said:

Broken: https://pastebin.com/UFYYjVvK

:sad face:

I'm working on using other security methods though. This is only a proof of concept anyway, lol :D/>