await/promises/etc mostly exist to solve the problem that JavaScript doesn't have threads so it can't wait for callbacks.
About JavaScript, many other languages have had async/await for a long time. I have no idea why JS made such a huge deal of promises, I guess they're better than the callback hell before. Of course, in most languages using async isn't nearly as important for performance because they have thread pools.
Some interfaces aren't and won't be asynchronous (like Linux file IO) so eventually JS will support proper threads and we can stop talking about how great asynchronous programming is (it isn't).
Maybe promises come before async/await, in an evolutionary sense. Same way that for-each loops seem to precede generators / yield. C# added Task before the syntax sugar of async/await. Java currently has Future, and I expect async/await to finally show up in about 10 years time...
Just wanted to write that ;). Despite being C# developer and often smiling at the state of the Java language, I think Java will get async/await faster than in 10 years. I am more optimistic about it.
Node has threads in C++ for that sort of thing. Async programming is a big deal for performance. That's essentially the main reason Node is any faster than Python. If you use fully async Python on uvloop, you can get comparable performance.
It is ultimately a failure of language and runtime that programmer has to manually specify where he wants to make asynchronous vs. synchronous functions to get the optimal performance.
> that programmer has to manually specify where he wants to make asynchronous vs. synchronous functions to get the optimal performance.
programs aren't just pure computations. There are plenty of times when you want a specific event to happen at a specific time (as in, wall-clock), and plenty of times when you don't care when something computes as long as you end up getting a result at some point.
You don't get reliable wall clock time unless you're working in RTOS. In a threaded OS everything in userland is async to an extent. In this school of thought, having to specify that something should be async manually could be seen as a failure of the language.
It's insane that we're still using systems without ECC RAM. As memory shrinks bit errors get progressively more common. The more memory you have the better chance of corruption as well of course.
Literally everything else that holds "data" has been using some form of error correction forever. Hard drives, SSD's, USB flash drives, file systems, databases, even network packets. Even HDMI uses error correction, and how important is momentary pixel corruption on a screen???
It's totally insane that we're not using ECC with such large amounts of RAM built on tiny processes. Its definitely just a cartel artificially maintaining a situation that's bad for everyone not selling server chips.
Eh, most developers I know are lazy and won't even measure the performance of the thing they're building if it's "good enough". I can't remember the last time any of us fired up a profiler. Optimization is generally hard and un-fun.
On the other hand, developers love to build shiny new stuff more than they like using things that are already there. The "Optimize" part you're talking about is more "reinvent the wheel" in my experience.
Figuring out how to use X new library isn't fun. Building this cool thing that does the same thing but better is a lot of fun! That's why things get overengineered and built for "scale", which is probably mostly what you'r referring to. Instead of taking something off the shelf that would work fine some developers are compelled to build something that can handle the entire traffic of the internet. They don't achieve this by optimizing what's there, they do it by building an enormously complex system for no reason :)
> They don't achieve this by optimizing what's there, they do it by building an enormously complex system for no reason :)
This aspect of the industry drives me absolutely insane. I've seen this at every single company I've worked at. I feel like I'm taking crazy pills. Am I the only developer that sees tech as merely a tool? I don't want to build a massively complex system that scales to infinity and does everything for everyone. I don't want to build everything from scratch. I want to build dead simple, boring software that accomplishes a goal and is easy to maintain, so that I can go home and not worry about it.
Travis legally has control of the company just like an owner would. Nobody can "force" him to leave on run his company as certain way. Benchmark is just whining because they can't get their way.
Benchmark agreed to let him have permanent control when they invested, if they didn't want that they shouldn't have signed the contract.
> Benchmark agreed to let [Kalanick] have permanent control when they invested, if they didn't want that they shouldn't have signed the contract
Invisibly stapled to every contract is the entire corpus of relevant law. Delaware, for instance, protects minority investors from certain categories of abuse. If the claims in this letter are true regarding Kalanick telling Uber's Board that he was going to sign certain voting rights agreements, and then he did not do that, it could be grounds for finding violations per those laws.
Disclaimer: I am not a lawyer. This is not legal nor investment advice.
Well, North korea has been working on nukes for like 40 years and there hasn't been a war yet so I don't think the US is as eager as you think.
You don't see anything wrong with a madman in a country always on the edge of collapse that's constantly threatening to turn the USA into a crater having nuclear weapons?
Kimmy is over there threatening to bomb out the US and Japan and put everyone's heads on pikes pretty much weekly. I don't recall even our crazy fucker president Trump saying anything remotely close to that.
Yeah, but they're always just threats, that's kind of the point for him. Its always for the audience at home.
Prevailing wisdom seems to be that Kim treats nuclear weapons as an important deterrent from invasion, not a first-strike weapon. The US doesn't have much appetite for invasions atm, so the chances the missiles will ever be fired is pretty remote even if he does have them.
It's different if you have baby nukes you can't launch, and if you have MIRV ICBMs with mastered launch from submarines; i.e. one submarine capable of wiping out the whole west coast. There was recent noise that NK is testing (so far unsuccessfully) submarine launch for their new ICBMs; once they are successful, it stops being kindergarten stuff but a global issue.
I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible).
Just so nobody freaks out, this is cracking weak passwords, not broken WPA.
I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home networks and 60% for businesses. The attack is completely passive if you don't want to be noticed, and with a cheap dish you can pickup both ends of the handshakes from up to around a quarter mile away (line of sight).
> Just so nobody freaks out, this is cracking weak passwords, not broken WPA.
I beg to differ. The fact that WPA is subject to a passive attack at all is a defect. It should use a PAKE, which would entirely avoid this type of attack.
There are simple balanced PAKE protocols that would do the trick. DH-EKE, SPAKE2, J-PAKE, and even the venerable SRP would all work. I believe that several are old enough that no patents are possible, and, even when WPA was standardized, something should have been available.
Yes, this is still a major problem with WPA. Also the fact that certain control packets aren't authenticated is nearly unforgivable. If correctly designed the only reasonable attack on wifi would be channel jamming, sadly after many years this still is not the case.
WEP, WPA, WPA2... why keep reinventing the same wheel? Each new iteration inevitable turns out to be less-than-perfect and keep adding more and more complexity and overhead - for one, join/leave times keep increasing, up to a point where we have a separate standard (802.11r) just to get back pre-WPA roaming speeds (at cost of even more protocol complexity overhead).
Here's crazy idea: Why not run open network + IPSEC, or heck, even OpenVPN? Obviously, drop all non-VPN traffic right on the AP (or first router after it) to nip freeloaders in the bud.
IPSec and OpenVPN are complex like hell and not very well supported across OSes (think of the UI too). This is why I'm waiting for Wireguard.io, it looks like a step in a good direction.
I've been experimenting with this exact kind of network setup -- open WiFi that only allows packets to and from the WireGuard endpoint. The nice part is that it means I just have WireGuard on all the time, and because it roams, when I connect to a different WiFi networks, I remain on my home network automatically. I've also been putting my actual wlan0 interface in a separate namespace, isolated from real things. This way there's no chance of leaking data: https://www.wireguard.com/netns/#the-new-namespace-solution
Most captive portal routers don't block DNS (because they use iptables rules to handle authentication). That's why you can use iodine to proxy TCP-over-DNS on such APs. So if you just had an open access point, unless you provided no DNS servers except over VPN, people would still be able to use your AP.
Presumably you want to reply to DNS requests for a hostname for your captive portal. You might try to just use a raw ip address, but then you can't use https. So then you have the problem that you can't just reply with a fake answer for other domains due to caching. E.g. Windows caches negative responses for 5 minutes, which would be a pretty bad experience for your customers.
I guess you might be able to just fail to reply to DNS requests for domains outside you captive portal, I have no idea if anyone has tried that or there might be other complications.
Edit: Actually not replying wouldn't work great either because then the user can't be redirected to the captive portal. This might be less of an issue today since most devices have standardized a way to detect captive portals using a small set of hostnames.
Aside from custom root certs being installed, https is out either way, not only with IP address, right? HSTS makes that even more of a problem, and pinning makes even the custom root cert a problem. Captive portals seem like an increasingly fragile idea, except that OSes increasingly intervene appropriately.
...and bring up UI (sandboxed browser) if anything else than expected short 2xx was received.
Step 2) Mobile device reuse same cookies for the same portal second time around, so portal can recognize returning user and let them in without annoying with login prompt each time.
Assuming mobile device has a separate cookie jar for this, and captive portal is HTTPS with proper certificate, and doesn't try to break other people's SSL, that is pretty secure. Sure, this is not the most efficient protocol, but up-side is - it's open-ended. You can fit here anything from "press here if you agree to behave" to complete walled garden like hotspot on a train that shows you interactive map, schedule and transport connections available on the next stop along with small banner asking $1 for full internet access.
You just reply to any DNS request with your own server's IP, which accepts any HTTP requests with a redirection to the captive portal. The replies can have low TTLs to avoid the caching problem.
Newer captive portals (FON with latest firmware for example) are blocking iodine by being clever about which request to answer (bunch of A and AAAA with some of responses being CNAMEs, which are quickly followed by resolution of just received answers to A/AAAA), and which to block (bunch of NULL queries or "dangling" CNAMEs that are not followed by A/AAAA).
That being said - that's a bit over the top. The only reason I wouldn't want my AP to be open and unfiltered is - I don't want any junk being sent out which is attributable to me (by IP), and which I have no control over. Iodine, being a tunnel will only transport to "guest"'s server and go into the wider Internet with their server's IP.
If somebody is in enough of a squezze to jump over that sort of hoops, and there're no costs/risks for me - let them have it. I'm fine with that.
It doesn't give you a hash to crack. It reduces your speed of guessing passwords from "how quick can you hash X", which is millions of times per second, to "how many times can I attempt to get in before the access point blocks me".
This major issue with WPA password cracking today is that it can be done "offline". You can pull the handshake out of the air and bang on it as long as you want. It's pretty much the same thing as trying to guess a password from some leaked hashes vs trying to guess a password using the gmail interface.
I'm not sure how PAKE works, but how would an AP block you? MAC address are forgeable. And any nonce an AP sends down as a one-time salt would be visible to you and you could still just brute force it offline.
EDIT: After reading up on SPAKE2, it's basically just a Diffe-Hellman exchange. You can still totally do a brute force because you know what the first encrypted payload should look like and you can listen in for that encrypted message and use that as your "test that you got it right"
I think that at the end of the day, no matter what key stretching techniques you use. A bad starting key results in a bad end key.
You can't brute force a nonce offline when you don't know if you answer is right unless you ask the AP. Different protocols than sending hashes where you can tell if your hash is correct just by looking at it.
You are right that the AP couldn't block you without blocking everyone, but since you need to check your answer with the AP for each guess your attack becomes extremely visible. I guess you could still DDOS the AP by sending auth requests faster than it allows but that doesn't hurt the channel any more than barrage jamming which is un-blockable.
But you can capture the first encrypted packet from the router, and you know what the protocol is to test if your decoded version is correct. I still don't see how this helps.
This is a reasonable guess at how encryption works, but it's also flawed. The key you need to crack on a Wireless Router isn't the key that's used for actual encryption of data, but rather the key used to set up that encryption in the first place.
Basically, your keys are used to handshake with the access point, and then exchange a new set of temporary keys for the duration of your connection. These temporary keys (which are exchanged during the handshake, and encrypted by something which involves your original keys) are then used to encrypt user data.
Because the data are encrypted with new keys for each connection, and those keys aren't based on the original keys in any way, knowing the plain text version of the data you're trying to decrypt doesn't help. You might be able to recover the temporary key, but you can't use this by itself to join the router, and the key is thrown away when that user makes a new connection. (These keys are also usually quite large, random, and very resistant to brute force methods anyway.)
HTTPS works similarly, and it needs to, because many (many!) websites start with the plain text "<html" which would make it trivial to brute force the keys offline otherwise.
The difference between an access point and HTTPS on a web server is that the access point doesn't have an identity to tie the key exchange. You can sprinkle DH here and there to incrementally improve things but it's not going to be bullet proof against active man-in-the-middle attacks.
With things like Lets Encrypt, having each access point own a short lived certificate becomes possible and you can then bootstrap a secure key exchange.
PS: I have no idea which direction WPA3 is going. They might be doing something without certs but a TOFU trust model instead. Either ways, it is possible to design something better than WPA/WPA2 but don't think it's trivial because the constraints aren't the same as existing secure protocols.
>>>The difference between an access point and HTTPS on a web server is that the access point doesn't have an identity to tie the key exchange. You can sprinkle DH here and there to incrementally improve things but it's not going to be bullet proof against active man-in-the-middle attacks.
??? Isnt the MAC address an identity for the AP ?
I always had a doubt about HTTPS . Say Im connecting through a proxy server to a website. The exchange of keys for HTTPS connection happens through this proxy server, means it can capture those and decrypt the connection whenever it wants , right ?
Thanks for your reply.
No, just an address. To be an identity, there must be some way for the AP to demonstrate that it is the right owner of that MAC, otherwise any router can simply copy the MAC.
HTTPS sites do this by getting a CA to vouch for them (in the form of a digitally signed certificate). Tor sites do this by having their address being a representation of their public key, and proving they have the corresponding private key.
I always had a doubt about HTTPS . Say Im connecting through a proxy server to a website. The exchange of keys for HTTPS connection happens through this proxy server, means it can capture those and decrypt the connection whenever it wants , right ? Thanks for your reply.
No, thanks to Diffie-Hellman[1], you can exchange keys with a remote server over a non-secure channel in a way that anyone listening can't figure out the key.
Of course, this happens after the server has proven it is who it says it is, by using one of the methods above. Otherwise, the proxy could pretend to be the server, and exchange keys itself with you.
You can have bulletproof protection against MITM as long as you have a shared secret so it's possible with wifi. The other answers in this chain about PAKE have details.
It is correct that HTTPS and other protocols generate temporary keys for each connection but there's another much older reason why this is done, particularly for TLS.
Asymmetric encryption algorithms are, in general, orders of magnitude slower at encryption than AES. With these protocols the initial secure connection is done using asymmetric cryptography. It makes sense to use the established secure channel to exchange another set of keys and switch over to AES or another symmetric algorithm immediately.
Nowadays the two ends negotiate a key exchange to allow things like perfect forward secrecy as well, so this is becoming a historical footnote to an extent.
I'm not a crypto expert and I'm sure even if I was it would be difficult to explain. Wiki page on SRP has a good description though:
Like all PAKE protocols, an eavesdropper or man in the middle cannot obtain enough information to be able to brute force guess a password without further interactions with the parties for each guess.
In layman's terms, given two parties who both know a password, SRP (or any other PAKE protocol) is a way for one party (the "client" or "user") to demonstrate to another party (the "server") that they know the password, without sending the password itself, nor any other information from which the password can be broken. Further, it is not possible to conduct an offline brute force search for the password.
To clarify, I agree that the individual connection key is safe from brute force. But I feel like the initial shared key is vulnerable. I doubt you'd get MITM on your connection, but you can still get a bad actor on your network.
I feel like the initial key exchange should be done with something most resource intensive than elliptic curves.
They are a current feature but not the baseline which means in practice implementations are buggy or non existent. I've had a few nicer routers where I could turn the options on but most clients are not able to connect :( .
I need to be in the baseline standard to get qualified or nobody will implement it.
PAKE is awesome, yet not very well-known :-( In a nutshell a PAKE scheme guarantees that (1) a passive attacker has no way to brute force passwords at all, and (2) that an active attacker can at most test one candidate password per authentication attempt.
PAKE is used by Thread (IOT protocol built on top of IEEE 802.15.4: https://threadgroup.org/ and it's precisely its use of PAKE that makes it one of the most secure wireless protocols IMHO. Disclosure: I helped security-review it during its design.) Various PAKE schemes exist but a simple one based on Diffie-Hellman works like this (called DH-EKE):
1. Client selects random priv, pub key pair: a, g^a
2. Server selects random priv, pub key pair: b, g^b
3. Client sends its pub key encrypted with client's password: E(g^a, passwd)
4. Server sends its pub key encrypted with client's password: E(g^b, passwd)
5. Client and server each decrypts the packets (with the password that they both know) and get each other's pub keys: g^a, g^b
6. Client and server proceed with standard Diffie-Hellman: they compute g^ab use this value as an encryption key
7. Client and server do a message exchange encrypted with g^ab, to verify they both derived the same key.
Note: I demonstrate the scheme DH-EKE because it's simple. But please know this scheme is flawed when naively implemented. In theory it should be safe when used with an elliptic curve variant using Elligator https://elligator.cr.yp.to/ but I haven't seen much research and peer reviews of Elligator... Other PAKE schemes are considered perfectly secure (but their complexity makes them unsuitable to be explained in an HN comment, eg: J-PAKE.)
What can an "offline" attacker do? He can passively sniff the packets and get E(g^a, passwd) and E(g^b, passwd) but there is no way for him to bruteforce the password. He can try to decrypt the packet with candidate passwords, but he does not know when he guesses the right one, because a successful decryption will reveal g^a or g^b however these value are indistinguishable from random data (when using Elligator because that's exactly what it guarantees: that a pub key is indistinguishable from random data.) And even if he guessed right, he would obtain g^a and g^b, but would not be able to decrypt any further communications as the use of Diffie-Hellman makes it imposible to calculate the encryption key g^ab.
What can an "online" attacker do? If he actively MiTM the connection and pretends to be the legitimate server, he can send his own E(g^b, passwd) to the client using one guessed candidate password. If he guessed wrong, then the client will decrypt to an incorrect g^b, will not calculate the right g^ab, and step 7 will fail. Good. At least the client can detect a (failed) password guess attempt. And that's all the attacker can do. Each authentication attempt gives him only 1 chance to test 1 password. If, out of frustration, the client tries to retype the password and re-auth 3 times, then the attacker can at most try to guess 3 candidate passwords. He can't bruteforce many passwords.
You don't need Elligator to make DH-EKE work - you can do it with old-fashioned DH. The property you need is roughly that D(E(g^a, pw), guess) has the same distribution regardless of whether pw == guess. If the group is Z_p and g generates the whole group, then E could be a pseudorandom permutation of [1,p-1].
The problem with ECDH here is that group elements aren't just numbers.
To do this formally, you need to consider information entropy.
This is all about how you generated your password. 10 characters of totally random mixed case, numbers and punctuation gives about 60 bits of entropy which is strong enough.
HOWEVER, that calculation only works if all 10 characters were generated uniformly and randomly. Humans are terrible at this. Now, maybe your trick for turning words into safe passwords is great, but there is no way to be sure. Sadly, remembering 10 random characters is hard.
Luckily, easy to remember and strong passwords are possible. The system I would recommend is diceware: www.diceware.com
That diceware system is complete Snowden-level paranoia. Close the curtains! Burn after reading! For everyday techie joe a passphrase + a memorized complex password is just enough. If you're on the internet asking for a strong password method and reading diceware.com you may have your priorities set wrong like an untrained spy.
I would love to see a comparison between where physically and which modifiers are used for each character are, and the strength of a password.
Is a password which is very easy/comfortable to type out physically any more/less strong than another of the same length?
I ask this because I often use a visual pattern on the keyboard for a password and I don't recall which characters they may be, but I recall the pattern in need to type out on a qwerty kb
There was a nice comic/picture of this. I tend to follow it. Basically using 3-4 short words as a phrase instead of random characters. You can toss special characters inbetween/before/after. They are also much easier to remember. Password "FoolMeOnce!ShameOnMe" for example.
Well, it was an example, but I agree. For everything that I can I use keepass with better autogenerated random passwords, but for things like home WiFi and others that I may have to type in manually I'll use a phrase like this. A more random phrase is certainly more secure.
log2(10^16) = 53 bits of entropy or 300 years if your attacker can do a million guesses per second (the link says 1000 keys per second, but that's on the CPU).
You could also use `cat /usr/share/dict/words` instead of the `curl`, which is a much larger word list, but you get impractical passwords like "globular cellulose's malnutrition's dangling".
shuf is not a crypto tool, and the GNU coreutils are written to be cross-platform, even where /dev/urandom doesn't exist, or is unreliable. That's my guess, at least.
Wifi password cracking is only around 1000X slower than a SHA256 brute-force if I remember right. So your password needs to be secure enough that if a hash of it was leaked it would never be cracked.... So very strong.
WPA enterprise using certificates is usually much harder to crack since you need to interrogate server, you can't just brute force hash. This method only really applies to PSK mode (home networks and small businesses usually)
That should be enough, but keep in mind that you might be entering the password on a lot of non-keyboards. 20 lowercase letters is faster and far more secure. Even 14-15 lowercase letters is soundly better.
If you consider your random keyspace with 26 * 2 chars + 10 numbers + 20ish special chars then to crack 10 letters you'll have to try an average of ((26 * 2 + 10 + 20) ^ 10) / 2 = 6.8724016e+18 keys. If you then assume around 3 million hashes per second it still takes around 72641 days to crack your password.
Edit: As another comment said, just make sure it's not easy to guess based on rainbow tables and whatnot
I read in many places that the easiest way to generate a really strong password is to memorize a fairly long sentence and use the first letter of each word.
However definitely DONT use a quote or lyrics. Needs to be something unique.
Would you please simply type "whatever", instead of this "W/E" nonsense? Considering the amount of 8+ character adjectives you used, you clearly aren't trying to be less verbose.
You understood him perfectly well, what exactly is your criticism? If he agrees to comply to your arbitrary standards of style, only to say the exact same thing, will you agree to "please simply" refrain from being obnoxious for no reason?
Understanding for me required a Google search. It's quite a nuisance for me to have to google an uncommon abbreviation for one of the most common words in my native language.
In your opinion, is setting up a RADIUS server and using WPA2-Enterprise worth it for a consumer? I'm pretty paranoid, and also think it could be an insightful experience to tinker around with networking tools.
Any advice for what constitutes a strong or weak password in this context?
I wanted to do that in my home, but good luck getting IoT devices to connect which may be a good thing..)
You'd probably have to set up a separate network for those devices (again, technically a good thing) which can be a source of some friction.
It used to be only good routers had a guest network option, but now even $20 TP-Links can use Radius for the main network and WPA2 for the guest network; though I'm not sure you can do something like whitelist by MAC on only the guest network.
>In your opinion, is setting up a RADIUS server and using WPA2-Enterprise worth it for a consumer?
It can be a pain in the ass when the consumer device requires a valid SSL certificate. On active directory networks this isn't much of a problem because a CA is pushed out to devices, but automating this at home can be a bigger issue.
About JavaScript, many other languages have had async/await for a long time. I have no idea why JS made such a huge deal of promises, I guess they're better than the callback hell before. Of course, in most languages using async isn't nearly as important for performance because they have thread pools.
Some interfaces aren't and won't be asynchronous (like Linux file IO) so eventually JS will support proper threads and we can stop talking about how great asynchronous programming is (it isn't).