[SUGGESTION] Different password/PIN to ACP

Do not post support requests, bug reports or feature requests. Discuss phpBB here. Non-phpBB related discussion goes in General Discussion!
Get Involved
ToonArmy
Former Team Member
Posts: 4608
Joined: Sat Mar 06, 2004 5:29 pm
Location: Worcestershire, UK
Name: Chris Smith
Contact:

Re: [SUGGESTION] Different password/PIN to ACP

Post by ToonArmy »

Desdenova wrote:
Marshalrusty wrote:While the article's content is valid (for maximum safety, using sudo is better than logging in as root), it is not at all the same thing being brought up here.
Bzzzt, wrong. :roll:

The similarities between both are quite obvious (and also, you shouldn't be presenting your opinion as die-hard fact).
There are similarities, sudo can produce a root shell just as su does for example. However root shells are a bad idea, forget to lock it and you're stuffed. If I forget to lock my shell after using sudo the attacker only has a 15 minute window (by default) to make an attack.

As to password policy authenticating with ones own password or using a shared password that's up to you.
Chris SmithGitHub
User avatar
Marshalrusty
Project Manager
Project Manager
Posts: 29334
Joined: Mon Nov 22, 2004 10:45 pm
Location: New York City
Name: Yuriy Rusko
Contact:

Re: [SUGGESTION] Different password/PIN to ACP

Post by Marshalrusty »

Desdenova wrote:
Marshalrusty wrote:While the article's content is valid (for maximum safety, using sudo is better than logging in as root), it is not at all the same thing being brought up here.
Bzzzt, wrong. :roll:

The similarities between both are quite obvious (and also, you shouldn't be presenting your opinion as die-hard fact).
"Bzzzt"? Seriously? :shock:

Quoting just that one line of what I said makes it seem like I didn't back up my opinion. The least you could do is at least read my post and understand what I said before pretending like it's so much beneath you. I'm also not sure where I made it sound like anything I said was "die-hard fact" anymore than you did. Nowhere did I deny there being any "similarities"; there are similarities between phpBB and SMF, but that doesn't mean every concept applied to one can be applied to the other.

In this case, you're comparing permissions on an OS with permission on a bulletin board program. The original poster specifically stated that the purpose for multiple passwords was protection from one being stolen, which is not the purpose of sudo. You then attempted to apply the actual purpose of sudo to phpBB, which also doesn't really work because phpBB is a bulletin board system. It could be made to work, but there's no problem with running operations as an administrator in phpBB. That is, unless you've found CSRF vulnerabilities somewhere (in which case the problem is the vulnerability).

nn- and I explained that since we are supposing the first password was stolen, the second password would be stolen in the same way.
🇺🇦 Made in Ukraine, exported to the USA 🇺🇸

Have comments/praise/complaints/suggestions? Please feel free to PM me.

Need private help? Hire me for all your phpBB and web development needs
User avatar
Highway of Life
Former Team Member
Posts: 6048
Joined: Wed Feb 02, 2005 5:41 pm
Location: Bend, OR
Name: David Lewis
Contact:

Re: [SUGGESTION] Different password/PIN to ACP

Post by Highway of Life »

MNA wrote:Yes, I have something like this.

But I am in good situation, because I've got access to server's shell, not everyone has that possibility, so let's help them.
Even shared hosts can set a password on a directory without shell/root access.
User avatar
MichaelC
Consultant
Consultant
Posts: 3642
Joined: Mon Dec 21, 2009 3:36 pm
Location: London, UK
Name: Michael Cullum
Contact:

Re: [SUGGESTION] Different password/PIN to ACP

Post by MichaelC »

If you want a second password you could use .htaccess like I do for the /adm and /mcp files.
:)
Formerly known as Unknown Bliss.
Formerly Website Team Lead/Manager & Development Team.
Please don't PM me for support (or stuff that belongs in the forums or tracker) but otherwise feel free
Rhet-or-Ric
Registered User
Posts: 306
Joined: Sun Apr 06, 2008 1:38 pm

Re: [SUGGESTION] Different password/PIN to ACP

Post by Rhet-or-Ric »

.
I was just thinking about ten or so minutes ago about the idea of having a second password for the ACP and through the search tool found this topic. The second password idea just popped into my head, for some reason.

Anyway, I have read all the posts in this thread and it certainly seems that most don't approve. Or don't think it's necessary. Or other opinions.

But I wonder if it is actually possible with some kind of a hack?

Yes, I read about .htaccess/.htpasswd which I feel uncomfortable with.

So setting aside all the opinions, I am wondering if it really would be so difficult to set up?

In other words, is it at all possible without using .htaccess/.htpasswd?

Thank you.

.
User avatar
Erik Frèrejean
Former Team Member
Posts: 9899
Joined: Tue Oct 09, 2007 9:09 am
Location: The Netherlands, 3.0.x Support Forum
Name: Erik Frèrejean
Contact:

Re: [SUGGESTION] Different password/PIN to ACP

Post by Erik Frèrejean »

Marshalrusty wrote:
t_backoff wrote:May I inquire as to why you dont like usnig them? Also, can you provide a few of those sites? I'd like to read their FAQ or some other document that states why they prefer you don't.
American Express's website limits you to 8 alphanumeric characters. I've asked them before what they could possibly be thinking, but received no response.
My bank account uses a 6 digit password. I still can't think of a good reason to have that as limit especially for something like a bank account :/
Support Toolkit | Support Request Template | Knowledge Base | phpBB 3.0.x documentation
I don't give support via PM or IM! (all unsolicited pms will be trashed!)
User avatar
Marshalrusty
Project Manager
Project Manager
Posts: 29334
Joined: Mon Nov 22, 2004 10:45 pm
Location: New York City
Name: Yuriy Rusko
Contact:

Re: [SUGGESTION] Different password/PIN to ACP

Post by Marshalrusty »

Rhet-or-Ric wrote:.
I was just thinking about ten or so minutes ago about the idea of having a second password for the ACP and through the search tool found this topic. The second password idea just popped into my head, for some reason.

Anyway, I have read all the posts in this thread and it certainly seems that most don't approve. Or don't think it's necessary. Or other opinions.

But I wonder if it is actually possible with some kind of a hack?

Yes, I read about .htaccess/.htpasswd which I feel uncomfortable with.

So setting aside all the opinions, I am wondering if it really would be so difficult to set up?

In other words, is it at all possible without using .htaccess/.htpasswd?

Thank you.

.
So I'll raise the same questions again...

What are you trying to protect against?
and
In your scenario, would having 3 or more passwords be better than having 2?
🇺🇦 Made in Ukraine, exported to the USA 🇺🇸

Have comments/praise/complaints/suggestions? Please feel free to PM me.

Need private help? Hire me for all your phpBB and web development needs
Rhet-or-Ric
Registered User
Posts: 306
Joined: Sun Apr 06, 2008 1:38 pm

Re: [SUGGESTION] Different password/PIN to ACP

Post by Rhet-or-Ric »

.

Now that's basically what I thought I was reading in many of the previous answers -- asking why someone would wish to have two passwords as asked in the OP.

I'm very sorry, but what difference does it make? Why must someone answer that question? In fact, what business is it of anyone's?

I am simply asking if it is possible. That's all. No complicated discussion. Maybe I have reasons that I don't care to share with anyone in public.

Good golly, what makes this such a delicate question?

.
Rhet-or-Ric
Registered User
Posts: 306
Joined: Sun Apr 06, 2008 1:38 pm

Re: [SUGGESTION] Different password/PIN to ACP

Post by Rhet-or-Ric »

.
Marshalrusty wrote: and
In your scenario, would having 3 or more passwords be better than having 2?
And, what scenario are you referring to? I don't understand that question? Sorry.

.
User avatar
Marshalrusty
Project Manager
Project Manager
Posts: 29334
Joined: Mon Nov 22, 2004 10:45 pm
Location: New York City
Name: Yuriy Rusko
Contact:

Re: [SUGGESTION] Different password/PIN to ACP

Post by Marshalrusty »

Rhet-or-Ric wrote:I'm very sorry, but what difference does it make? Why must someone answer that question? In fact, what business is it of anyone's?
This is the Discussion Forum, not the MOD Request Forum. Therefore, we are discussing the idea and seeing whether or not it has merit for security applications. As mentioned above, a number of us do not see any added security with this, so I was asking whether you had perhaps thought of something we didn't see.
Rhet-or-Ric wrote:I am simply asking if it is possible. That's all. No complicated discussion. Maybe I have reasons that I don't care to share with anyone in public.
Of course it's possible. What could possibly prevent it from being possible? I'm sure you know that phpBB is opensource, so you can add absolutely anything, including a second or third password.
Rhet-or-Ric wrote:Good golly, what makes this such a delicate question?
It's not. This is the Discussion Forum and it's perfectly natural that we are going to attempt to understand the merits of any suggestion before providing recommendations, especially if it's security related.
🇺🇦 Made in Ukraine, exported to the USA 🇺🇸

Have comments/praise/complaints/suggestions? Please feel free to PM me.

Need private help? Hire me for all your phpBB and web development needs
Rhet-or-Ric
Registered User
Posts: 306
Joined: Sun Apr 06, 2008 1:38 pm

Re: [SUGGESTION] Different password/PIN to ACP

Post by Rhet-or-Ric »

.

Fair enough, thank you for the answer.

I'm afraid, though, I don't think it would be wise for me to explain for what purpose I see it to be a useful tool. I hope you can understand that there are some things that simply should not be discussed in public, especially when it has to do with security.

I will state, though, it has nothing to do with the strength of any particular password. Nor is it directly related to the possibility of the main board sign-in password being discovered by a nefarious individual.

Again, thank you for the answer.

.
User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 52768
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: [SUGGESTION] Different password/PIN to ACP

Post by stevemaury »

One obvious solution is to only use your admin account when you need to access the ACP. Use another for ordinary discussion. And make the admin account hidden online and make the Registered users group its default group.
I can stop all your spam. I can upgrade or update your Board. PM or email me. (Paid support)
Pony99CA
Registered User
Posts: 4783
Joined: Thu Sep 30, 2004 3:13 pm
Location: Hollister, CA
Name: Steve
Contact:

Re: [SUGGESTION] Different password/PIN to ACP

Post by Pony99CA »

Rhet-or-Ric wrote:I hope you can understand that there are some things that simply should not be discussed in public, especially when it has to do with security.
Why would talking about reasons be damaging to security? Talking about implementations may be, although "security by obscurity" is not much security anyway.

Anyway, to give you one possible implementation, add a second password field to the User table. Initially default that second password to the first one. Add that second password to the ACP user page where an admin can change it if he wants (there's really no need to add it to the UCP). Change the ACP log in to use the second password, not the first.

There may be other details that I omitted, but you get the gist, I hope.

Steve
Silicon Valley Pocket PC (http://www.svpocketpc.com)
Creator of manage_bots and spoof_user (ask me)
Need hosting for a small forum with full cPanel & MySQL access? Contact me or PM me.
updown
Registered User
Posts: 542
Joined: Sat Jan 05, 2008 6:53 am

Re: [SUGGESTION] Different password/PIN to ACP

Post by updown »

A second password doesn't make anything more secure. The only argument for it would be, that it is not used as often as the standard-password and makes it possibly more secure for catching by unencrypted transmission. But practically, that doesn't help to make something more secure in anyway.

A more secure way would be to make use of classic (banking-style) one-use PINs: Generate a list of them (best offline), update the database with the encrypted PINS in a separate table, ask for an additional PIN-ID at every LOG-In, only use each PIN once. THAT would be a Modification for more security, since it combines online- and offline-verification-methods.
Post Reply

Return to “phpBB Discussion”