Store Passwords Securely comments posted by Maik Schmidt @ Fri, 02 Jan 2009 19:18:15 -0000

Maik Schmidt — Fri, 02 Jan 2009 19:18:15 -0000

Cody:

The bcrypt approach is more secure, I think. bcrypt is used by OpenBSD and has been developed especially for hashing passwords. SHA, MD5 and friends were designed for calculating unique fingerprints of large amounts of data as fast as possible.

Under the hood bcrypt also hashes the password adding some salt, but it uses a hash algorithm that is computationally expensive. This makes it much more difficult to crack a password, because the attacker has to use the expensive algorithm, too.

In the section titled “How bcrypt() works” at http://bcrypt-ruby.rubyforge.org/ you can find a short and nice description of bcrypt.

Cheers,

Maik

Store Passwords Securely comments posted by Cody Russell @ Fri, 02 Jan 2009 17:59:58 -0000

Cody Russell — Fri, 02 Jan 2009 17:59:58 -0000

I don’t know much about cryptology or anything, and now I’m presented with two different options for authenticating users and storing passwords and I’m not sure which is the better one to use.

The first is Recipe #31 from Chad Fowler’s Rails Recipes book, and the second is yours.

Can you, or anyone really, tell me which of the two is the more modern/preferred/secure way of doing it?

User model, LDAP auth and associations posted by Phil Gardner @ Wed, 17 Dec 2008 21:37:39 -0000

Phil Gardner — Wed, 17 Dec 2008 21:37:39 -0000

I use Novell’s eDirectory in this context, eDirectory has a GUID attribute, I would use something like this at it is constant for the life of the object, email addresses, phone numbers and even first names and last names change. Marriage, Divorce, changed ISP etc all make using user attributes problematic.

Regards
Phil

Create Strong and Convenient Passwords posted by Steven Finnegan @ Tue, 02 Dec 2008 21:21:18 -0000

Steven Finnegan — Tue, 02 Dec 2008 21:21:18 -0000

YES! That worked!
Now that I see the problem, I should mention (ahem) that my macs are set up with case-sensitive filesystems. This was done because when developing RoR systems on a non-case-sensitive mac, I would then have problems with the deployed versions running under FreeBSD, which is case-sensitive. Looks like somebody is assuming a non-case-sensitive FS.

Thanks for all your help!

sjf

Create Strong and Convenient Passwords posted by Maik Schmidt @ Tue, 02 Dec 2008 18:25:42 -0000

Maik Schmidt — Tue, 02 Dec 2008 18:25:42 -0000

Hi, Steven!

I have setup a complete new Ruby environment in a Parallels virtual machine on Windows XP. I could not fully reproduce your problem, but found some strange behavior regarding the name of the YAML library. Please replace require 'YAML' in line 24 of ngrams.rb with require 'yaml' and try again.

Cheers,

Maik

Create Strong and Convenient Passwords posted by Steven Finnegan @ Mon, 01 Dec 2008 15:52:01 -0000

Steven Finnegan — Mon, 01 Dec 2008 15:52:01 -0000

I have 2 Macs (both intel)—both behave the same (though one may not be as current). Both return the following to your two commands:


Luna:~ sjf$ ruby -e 'puts $:'
/Library/Ruby/Site/1.8
/Library/Ruby/Site/1.8/powerpc-darwin9.0
/Library/Ruby/Site/1.8/universal-darwin9.0
/Library/Ruby/Site
/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8
/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/powerpc-darwin9.0
/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/universal-darwin9.0
.
Luna:~ sjf$ echo $RUBYLIB

Luna:~ sjf$

Create Strong and Convenient Passwords posted by Maik Schmidt @ Mon, 01 Dec 2008 15:15:16 -0000

Maik Schmidt — Mon, 01 Dec 2008 15:15:16 -0000

I guess there’s something wrong with your load path. What’s the output of the following two commands:

$ ruby -e ‘puts $:’
$ echo $RUBYLIB

Create Strong and Convenient Passwords posted by Steven Finnegan @ Mon, 01 Dec 2008 12:51:53 -0000

Steven Finnegan — Mon, 01 Dec 2008 12:51:53 -0000

Thanks for your help, Maik!

Well, you’re right, it’s not found. For what its worth, this is running under OS X Leopard. I believe I have everything updated to current releases.


Luna:~ sjf$ irb
>> require 'yaml'
=> false
>> require 'YAML'
LoadError: no such file to load -- YAML
    from /Library/Ruby/Site/1.8/rubygems/custom_require.rb:31:in `gem_original_require'
    from /Library/Ruby/Site/1.8/rubygems/custom_require.rb:31:in `require'
    from (irb):2

>> quit
Luna:~ sjf$ ruby --version
ruby 1.8.6 (2008-03-03 patchlevel 114) [universal-darwin9.0]
Luna:~ sjf$

Interestingly, it DOES seem to be on the disk…


Luna:~ sjf$ sudo find / -name yaml
Password:
/Developer/SDKs/MacOSX10.5.sdk/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/yaml
/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/yaml

Create Strong and Convenient Passwords posted by Maik Schmidt @ Mon, 01 Dec 2008 07:32:52 -0000

Maik Schmidt — Mon, 01 Dec 2008 07:32:52 -0000

Hi, Steven!

The ngrams gem needs the YAML library and tries to require it in line 24 of the file /Library/Ruby/Gems/1.8/gems/ngrams-0.1.0/lib/ngrams/ngrams.rb. Unfortunately, it cannot be found on your system although it’s part of the Ruby standard library (at least in version 1.8 which seems to be the version you’re using). Could you check, if you can reproduce the following irb session:

$ irb
>> require ‘yaml’
=> true
>> require ‘YAML’
/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/YAML.rb:87: warning: already initialized constant Resolver
/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/YAML.rb:88: warning: already initialized constant DefaultResolver
/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/YAML.rb:90: warning: already initialized constant GenericResolver
/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/YAML.rb:91: warning: already initialized constant Parser
/System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/1.8/YAML.rb:92: warning: already initialized constant Emitter
=> true

Cheers,

Maik

Create Strong and Convenient Passwords posted by Steven Finnegan @ Sun, 30 Nov 2008 20:28:03 -0000

Steven Finnegan — Sun, 30 Nov 2008 20:28:03 -0000

When I try to run this program (convenient_password.rb) I get the following errors.


/Library/Ruby/Site/1.8/rubygems/custom_require.rb:27:in `gem_original_require': no such file to load -- YAML (LoadError)
    from /Library/Ruby/Site/1.8/rubygems/custom_require.rb:27:in `require'
    from /Library/Ruby/Gems/1.8/gems/ngrams-0.1.0/lib/ngrams/ngrams.rb:24
    from /Library/Ruby/Site/1.8/rubygems/custom_require.rb:27:in `gem_original_require'
    from /Library/Ruby/Site/1.8/rubygems/custom_require.rb:27:in `require'
    from /Library/Ruby/Gems/1.8/gems/ngrams-0.1.0/lib/ngrams.rb:2
    from /Library/Ruby/Site/1.8/rubygems/custom_require.rb:32:in `gem_original_require'
    from /Library/Ruby/Site/1.8/rubygems/custom_require.rb:32:in `require'
    from /Users/sjf/Desktop/conv_pswds.rb:32

I have the ngrams gem installed.

User model, LDAP auth and associations posted by Maik Schmidt @ Thu, 20 Nov 2008 17:48:28 -0000

Maik Schmidt — Thu, 20 Nov 2008 17:48:28 -0000

In recipe 9 I only wanted to show how to use LDAP for authentication purposes, so I did not put the example code into any specific context.

Despite this your point is still valid, of course, and the problem you describe is nearly inevitable whenever you mix LDAP and relational databases. As far as I know there is no way to automatically ensure referential integrity between an LDAP repository and a relational database. You have to take care about it yourself and as you’ve said before: this is no fun.

There are several ways to deal with this problem. Unfortunately, none of them is perfect.

If you really need user information for business purposes and not only for authentication, you should try to manage as much of your user attributes as possible in the LDAP repository. For this purpose you can use ActiveLDAP, for example, and in my last book (http://pragprog.com/titles/fr_eir/enterprise-integration-with-ruby) I have devoted a whole chapter to this topic (you can read the beginning of the LDAP chapter online: http://media.pragprog.com/titles/fr_eir/ldap.pdf).

This strategy will at least help to keep the user data DRY and it makes operations on users a bit easier. But you still have to map the LDAP entities to database rows somewhere and therefore you need a key. I suggest to use a user’s e-mail address and map it to the according LDAP attribute. This way you can easily identify the user in your database right after you’ve read it from the LDAP repository.

Cheers,

Maik

User model, LDAP auth and associations posted by Michael Schuerig @ Wed, 19 Nov 2008 19:26:14 -0000

Michael Schuerig — Wed, 19 Nov 2008 19:26:14 -0000

Recipe 9 shows how to authenticate a user through an LDAP server. The user is implemented as a plain Ruby class, not an ActiveRecord model, which precludes any associations involving users.

In the past I’ve worked around this with association tables, relating logins to group memberships, say. Doing it that way is no fun, unfortunately.

Any suggestions on how to work with models that are not backed by a DB table?

Store Passwords Securely comments posted by Maik Schmidt @ Wed, 01 Oct 2008 16:27:15 -0000

Maik Schmidt — Wed, 01 Oct 2008 16:27:15 -0000

Johan:

I’m not sure if I’ve fully understood your problem. I suppose you’ve created views for creating and editing users and you’ve used Rails’ form_for() helper to manage a user’s attributes. And when editing a user the password’s hash value appeared in the password field?

Of course, your solution works, but wouldn’t it be easier to initialize the password fields in the edit view:

<%= password_field “password”, :value=>”” %>

This way you could set whatever default value you like and you could still name the password attribute “password”, which is slightly better than “password_hash” in my opinion.

Cheers,

Maik

Store Passwords Securely comments posted by Johan Allard @ Tue, 30 Sep 2008 00:01:19 -0000

Johan Allard — Tue, 30 Sep 2008 00:01:19 -0000

Ok, I’ve now updated some of the code and changed the following:


  def password_hash # instead of def password
    @password_hash ||= BCrypt::Password.new(self.hashed_password)
  end

    def self.authenticate(name, password)
    if user = self.find_by_name(name)
      user = nil if user.password_hash != password
    end
    user
  end

This will leave the password variable blank and won’t show up in the users password field, but will still be hashed properly when the password is set.

Store Passwords Securely comments posted by Johan Allard @ Mon, 29 Sep 2008 22:48:17 -0000

Johan Allard — Mon, 29 Sep 2008 22:48:17 -0000

Hi,

I just decided to implement the store passwords securely recipe and one thing that doesn’t make sense with is that since it’s using the password attribute when reading the password, this means that in my edit page, there’s now the encrypted password string being displayed in the password field, where’s I’d want it to be blank until I actually change the password for that particular user. Or am I missing something?

Cheers

Johan

A few suggestions posted by Maik Schmidt @ Tue, 23 Sep 2008 06:00:35 -0000

Maik Schmidt — Tue, 23 Sep 2008 06:00:35 -0000

Hi Bharat!

Thank you very much for your suggestions!

ad 1:
Mike’s and my book cover the same topics in a few places, but there’s no repetition neither in the recipes nor in the examples. My book presents solutions for typical enterprise environments that is for projects that have to integrate with existing infrastructures. Take the chapters about asynchronous messaging, for example. Mike shows how to implement lightweight solutions based on Ruby libraries while the samples in my book depend on full-blown message-oriented middleware.

ad 2:
You’re absolutely right: meta-programming is an important topic and it is important in enterprise environments, too. But I think it’s nearly impossible to explain good (and secure) meta-programming techniques in a recipe style and I’m afraid I cannot add much to Dave’s excellent screencasts. They are really great!

ad 3:
That’s a good suggestion and right now I’m improving the cross-references.

Regards,

Maik

A few suggestions posted by Bharat Ruparel @ Sun, 21 Sep 2008 22:26:18 -0000

Bharat Ruparel — Sun, 21 Sep 2008 22:26:18 -0000

Hello Maik,
I will definitely buy your book. The topics that you cover are quite useful. A few suggestions:

1. Please make sure that you do not repeat what has been already covered in Mike Clark’s excellent Advanced Rails Recipes book. It is OK to expand on or present a different angle on the same topic, but not OK to merely repeat what has already been explained in that book.

2. If you can include a few recipes on meta-programming, that would be excellent. For example, I had to struggle hard on creating “library” code that seamlessly takes care of US and UK dates even when they are represented as strings. Dave Thomas has done an excellent job of explaining meta-programming concepts in his screencasts. A few applications of meta-programming for Rails may not be a bad idea.

3. Looking at Bala’s comments, I can understand where he is coming from and I understand your response as well. Perhaps you want to follow the same model as Advanced Rails Recipes and Obie Fernandez’s equally good book the Rails Way? That is, make sure that the recipes are heavily cross-referenced so that the readers can connect the dots. If you have used outside sources to enhance and clarify your own thoughts, a reference to those will be very valuable. It is OK to present the fundamentals of a recipe without getting bogged down in details as long as you provide a way for readers to put things together.

Keep up the good work. I am looking forward to buying your book.

Regards,

Bharat

Holy Mackerel! posted by Joseph Grace @ Sat, 13 Sep 2008 22:53:06 -0000

Joseph Grace — Sat, 13 Sep 2008 22:53:06 -0000

Dear Maik Schmidt:

What a great book. Who would have thought an “Enterprise” book could contain so much great “random” (but I guess enterprisey) information, yet be so easy to read? I am surprised at how many recipes touch on projects I need to do.

I like the way you often discuss multiple ways of doing things in relation to each other, and how you factor in the currency of the solutions (even into future). It makes the book seem very current in a fast moving Ruby/Rails environment. You also keep the topics very brief and to the point, yet useful. They are all so… bite-size and yummy… just begging for experimentation.

I also like how you’ve grouped some recipes together, not just in the same category, but in such a way that they seem to build on one another. Your cross-references are great reinforcement (and reminders) for knowledge from other categories too. Nice.

I can hardly wait to try out many of your recipes. Thank you for writing this book.

Well done, bravo, & eureka!

Integrate ActiveMerchant With Rails posted by Maik Schmidt @ Wed, 10 Sep 2008 16:29:24 -0000

Maik Schmidt — Wed, 10 Sep 2008 16:29:24 -0000

Hi, Bala!

Thank you for your comment on the “Integrate ActiveMerchant With Rails” recipe.

You are right: the order process has been simplified to put emphasis on integrating ActiveMerchant with Rails. I did that to keep the recipe short and to not distract the reader from the recipe’s main topic.

Order processing is a problem that cannot be solved with a general solution and strongly differs from company to company. Hence, I did not devote a recipe to it and I assume that the reader is familiar with order processing at least in his environment. But you can find a more elaborate example in the “Transfer Money with PayPal” recipe.

In your blog entry you write the following:

“As soon as you create an order, you must set it’s initial state and process that order in the background. You can use run rake task using a CRON job that processes the orders. What happens if the Gateway is down? What will you recover from network errors? These things happen in the real world and your software that affect the bottom line must be able to handle it.”

Most of your points are valid although I do not think that all orders have to be processed in the background. I present solutions for all nasty real-world problems you’ve mentioned in the Messaging chapter. In addition, these solutions are more sophisticated and more reliable than cron jobs. For example, you’d better use asynchronous messaging for processing your orders in the background.

Maik

Integrate ActiveMerchant With Rails posted by Bala Paranj @ Wed, 10 Sep 2008 00:53:42 -0000

Bala Paranj — Wed, 10 Sep 2008 00:53:42 -0000

I find it shocking to read this recipe. Toy examples and no thoughts about robustness makes this a recipe for disaster.

Check out my critical feedback about this recipe on my blog:

http://bparanj.blogspot.com/2008/09/integrate-activemerchant-with-rails.html

Integrate ActiveMerchant With Rails posted by Bala Paranj @ Wed, 10 Sep 2008 00:51:24 -0000

Bala Paranj — Wed, 10 Sep 2008 00:51:24 -0000

I find it shocking to read this recipe. Toy examples and no thoughts about robustness makes this a recipe for disaster.

Check out my critical feedback about this recipe on my blog:

http://bparanj.blogspot.com/2008/09/integrate-activemerchant-with-rails.html

Recent Posts in Enterprise Recipes with Ruby and Rails | Pragmatic Forums

Store Passwords Securely comments posted by Maik Schmidt @ Fri, 02 Jan 2009 19:18:15 -0000

Store Passwords Securely comments posted by Cody Russell @ Fri, 02 Jan 2009 17:59:58 -0000

User model, LDAP auth and associations posted by Phil Gardner @ Wed, 17 Dec 2008 21:37:39 -0000

Create Strong and Convenient Passwords posted by Steven Finnegan @ Tue, 02 Dec 2008 21:21:18 -0000

Create Strong and Convenient Passwords posted by Maik Schmidt @ Tue, 02 Dec 2008 18:25:42 -0000

Create Strong and Convenient Passwords posted by Steven Finnegan @ Mon, 01 Dec 2008 15:52:01 -0000

Create Strong and Convenient Passwords posted by Maik Schmidt @ Mon, 01 Dec 2008 15:15:16 -0000

Create Strong and Convenient Passwords posted by Steven Finnegan @ Mon, 01 Dec 2008 12:51:53 -0000

Create Strong and Convenient Passwords posted by Maik Schmidt @ Mon, 01 Dec 2008 07:32:52 -0000

Create Strong and Convenient Passwords posted by Steven Finnegan @ Sun, 30 Nov 2008 20:28:03 -0000

User model, LDAP auth and associations posted by Maik Schmidt @ Thu, 20 Nov 2008 17:48:28 -0000

User model, LDAP auth and associations posted by Michael Schuerig @ Wed, 19 Nov 2008 19:26:14 -0000

Store Passwords Securely comments posted by Maik Schmidt @ Wed, 01 Oct 2008 16:27:15 -0000

Store Passwords Securely comments posted by Johan Allard @ Tue, 30 Sep 2008 00:01:19 -0000

Store Passwords Securely comments posted by Johan Allard @ Mon, 29 Sep 2008 22:48:17 -0000

A few suggestions posted by Maik Schmidt @ Tue, 23 Sep 2008 06:00:35 -0000

A few suggestions posted by Bharat Ruparel @ Sun, 21 Sep 2008 22:26:18 -0000

Holy Mackerel! posted by Joseph Grace @ Sat, 13 Sep 2008 22:53:06 -0000

Integrate ActiveMerchant With Rails posted by Maik Schmidt @ Wed, 10 Sep 2008 16:29:24 -0000

Integrate ActiveMerchant With Rails posted by Bala Paranj @ Wed, 10 Sep 2008 00:53:42 -0000

Integrate ActiveMerchant With Rails posted by Bala Paranj @ Wed, 10 Sep 2008 00:51:24 -0000