Re: framework/base tests failing (was: recent HashCrypt changes, and using salt-based password hashing)

2012-04-30 Thread Jacopo Cappellato
On Apr 23, 2012, at 3:47 PM, Adrian Crum wrote: I tried experimenting with the sleep timing and I also replaced the Thread.sleep call with a safer version, but the tests still failed. interesting... but if you change the Thread.sleep timeout from 200 to 2000 it works, right? Jacopo

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-29 Thread Jacques Le Roux
for having a few more bits of randomness as part of the salt. If you reply to this email, your message will be added to the discussion below: http://ofbiz.135035.n4.nabble.com/recent-HashCrypt-changes-and-using-salt-based-password-hashing-tp4571241p4591890.html

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-28 Thread Paul Foxworthy
. If you reply to this email, your message will be added to the discussion below: http://ofbiz.135035.n4.nabble.com/recent-HashCrypt-changes-and-using-salt-based-password-hashing-tp4571241p4591890.html To unsubscribe from recent HashCrypt changes, and using salt-based

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-27 Thread Jacques Le Roux
If you believe 1 is enough then +1 for me Actually as it's only salt, I think it's ok Jacques From: Adam Heath doo...@brainfood.com On 04/24/2012 07:49 AM, Paul Foxworthy wrote: Hi Adam, Maybe I'm missing something, but if the salt is a random length and might be 0 characters, doesn't that

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-26 Thread Adam Heath
On 04/22/2012 03:53 AM, Adrian Crum wrote: On 4/20/2012 9:00 PM, Adam Heath wrote: On 04/20/2012 12:13 PM, Jacques Le Roux wrote: Not sure you noticed but Builbot is no longer running http://ci.apache.org/waterfall?show_events=falsebranch=builder=ofbiz-trunkreload=none Yeah, noticed that

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-26 Thread Adam Heath
On 04/23/2012 08:40 AM, Jacopo Cappellato wrote: Adrian, the issue you are experiencing is interesting and I had a look at it; I was only able to recreate the same failures by changing the timeouts in UtilCacheTests.java at line 302 and 308; instead of: cache.setExpireTime(100); // line

Re: framework/base tests failing (was: recent HashCrypt changes, and using salt-based password hashing)

2012-04-24 Thread Jacopo Cappellato
This is really weird... I am wondering if there are issues caused by concurrent threads accessing the cache but the JUnit tests should be all executed in the same thread... so this should not be the case. Jacopo On Apr 23, 2012, at 3:47 PM, Adrian Crum wrote: The tests failed intermittently

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-24 Thread Jacques Le Roux
://www.bonsaierp.com.au/ -- View this message in context: http://ofbiz.135035.n4.nabble.com/recent-HashCrypt-changes-and-using-salt-based-password-hashing-tp4571241p4583331.html Sent from the OFBiz - Dev mailing list archive at Nabble.com.

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-23 Thread Jacopo Cappellato
Adrian, the issue you are experiencing is interesting and I had a look at it; I was only able to recreate the same failures by changing the timeouts in UtilCacheTests.java at line 302 and 308; instead of: cache.setExpireTime(100); // line 302 Thread.sleep(200); // line 308 I set:

framework/base tests failing (was: recent HashCrypt changes, and using salt-based password hashing)

2012-04-23 Thread Adrian Crum
The tests failed intermittently in the OFBiz buildbot (back when it was running). They always fail on my development machine. I tried experimenting with the sleep timing and I also replaced the Thread.sleep call with a safer version, but the tests still failed. -Adrian On 4/23/2012 2:40 PM,

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-22 Thread Adrian Crum
On 4/20/2012 9:00 PM, Adam Heath wrote: On 04/20/2012 12:13 PM, Jacques Le Roux wrote: Not sure you noticed but Builbot is no longer running http://ci.apache.org/waterfall?show_events=falsebranch=builder=ofbiz-trunkreload=none Yeah, noticed that buildbot wasn't emailing. Looking at that link,

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-20 Thread Jacques Le Roux
Yes I'm not too inclined too. This could be an option though for more security concerned projects... Jacques From: Pierre Smits pierre.sm...@gmail.com Hi Adam, How would that be? That would be one per tenant in a multi-tenant setup? I can imagine in a multi-tenant setup with the db backend

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-20 Thread Adrian Crum
On 4/20/2012 12:23 AM, Adam Heath wrote: On 04/19/2012 06:13 PM, Scott Gray wrote: On 20/04/2012, at 9:49 AM, Adam Heath wrote: On 04/19/2012 04:28 PM, Jacques Le Roux wrote: Looking forward for https://issues.apache.org/jira/browse/OFBIZ-1151 https://issues.apache.org/jira/browse/OFBIZ-2729

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-20 Thread Adam Heath
On 04/20/2012 12:53 AM, Pierre Smits wrote: Hi Adam, How would that be? That would be one per tenant in a multi-tenant setup? I can imagine in a multi-tenant setup with the db backend not on derby (as we all recommend) the upgrade/migration aspect can be enormous. Even more so in a HAFO-setup.

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-20 Thread Pierre Smits
Hi Adam, I can follow your reasoning. And it seems reasonable. But I would like to suggest to you to create a JIRA for this where patches are uploaded and can be tested in a separate ofbiz instantiation. This would then help with the creation of implementation procedures and documentation prior

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-20 Thread Adam Heath
On 04/20/2012 09:56 AM, Pierre Smits wrote: Hi Adam, I can follow your reasoning. And it seems reasonable. But I would like to suggest to you to create a JIRA for this where patches are uploaded and can be tested in a separate ofbiz instantiation. This would then help with the creation of

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-20 Thread Jacques Le Roux
From: Adam Heath doo...@brainfood.com On 04/20/2012 09:56 AM, Pierre Smits wrote: Hi Adam, I can follow your reasoning. And it seems reasonable. But I would like to suggest to you to create a JIRA for this where patches are uploaded and can be tested in a separate ofbiz instantiation. This

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-20 Thread Adam Heath
On 04/20/2012 12:13 PM, Jacques Le Roux wrote: Not sure you noticed but Builbot is no longer running http://ci.apache.org/waterfall?show_events=falsebranch=builder=ofbiz-trunkreload=none Yeah, noticed that buildbot wasn't emailing. Looking at that link, it appears that isis_ubuntu is offline.

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-20 Thread Jacques Le Roux
From: Adam Heath doo...@brainfood.com On 04/20/2012 12:13 PM, Jacques Le Roux wrote: Not sure you noticed but Builbot is no longer running http://ci.apache.org/waterfall?show_events=falsebranch=builder=ofbiz-trunkreload=none Yeah, noticed that buildbot wasn't emailing. Looking at that link,

recent HashCrypt changes, and using salt-based password hashing

2012-04-19 Thread Adam Heath
As some may have noticed, I recently changed the way ofbiz creates password hashes when it stores them in the database. Each time a new password is created, a bit of randomness is used, to create a random-length, random-content salt. This is placed at the beginning of the hashed password, stored

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-19 Thread Jacques Le Roux
Looking forward for https://issues.apache.org/jira/browse/OFBIZ-1151 https://issues.apache.org/jira/browse/OFBIZ-2729 https://issues.apache.org/jira/browse/OFBIZ-3006 Jacques From: Adam Heath doo...@brainfood.com As some may have noticed, I recently changed the way ofbiz creates password

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-19 Thread Adam Heath
On 04/19/2012 04:28 PM, Jacques Le Roux wrote: Looking forward for https://issues.apache.org/jira/browse/OFBIZ-1151 https://issues.apache.org/jira/browse/OFBIZ-2729 https://issues.apache.org/jira/browse/OFBIZ-3006 2729 doesn't apply for what I am doing. Here's the list of things that this

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-19 Thread Adam Heath
On 04/19/2012 04:49 PM, Adam Heath wrote: On 04/19/2012 04:28 PM, Jacques Le Roux wrote: Looking forward for https://issues.apache.org/jira/browse/OFBIZ-1151 https://issues.apache.org/jira/browse/OFBIZ-2729 https://issues.apache.org/jira/browse/OFBIZ-3006 2729 doesn't apply for what I am

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-19 Thread Jacques Le Roux
From: Adam Heath doo...@brainfood.com On 04/19/2012 04:28 PM, Jacques Le Roux wrote: Looking forward for https://issues.apache.org/jira/browse/OFBIZ-1151 https://issues.apache.org/jira/browse/OFBIZ-2729 https://issues.apache.org/jira/browse/OFBIZ-3006 2729 doesn't apply for what I am doing.

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-19 Thread Jacques Le Roux
From: Adam Heath doo...@brainfood.com On 04/19/2012 04:49 PM, Adam Heath wrote: On 04/19/2012 04:28 PM, Jacques Le Roux wrote: Looking forward for https://issues.apache.org/jira/browse/OFBIZ-1151 https://issues.apache.org/jira/browse/OFBIZ-2729 https://issues.apache.org/jira/browse/OFBIZ-3006

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-19 Thread Scott Gray
On 20/04/2012, at 9:49 AM, Adam Heath wrote: On 04/19/2012 04:28 PM, Jacques Le Roux wrote: Looking forward for https://issues.apache.org/jira/browse/OFBIZ-1151 https://issues.apache.org/jira/browse/OFBIZ-2729 https://issues.apache.org/jira/browse/OFBIZ-3006 2729 doesn't apply for what I

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-19 Thread Adam Heath
On 04/19/2012 06:13 PM, Scott Gray wrote: On 20/04/2012, at 9:49 AM, Adam Heath wrote: On 04/19/2012 04:28 PM, Jacques Le Roux wrote: Looking forward for https://issues.apache.org/jira/browse/OFBIZ-1151 https://issues.apache.org/jira/browse/OFBIZ-2729

Re: recent HashCrypt changes, and using salt-based password hashing

2012-04-19 Thread Pierre Smits
Hi Adam, How would that be? That would be one per tenant in a multi-tenant setup? I can imagine in a multi-tenant setup with the db backend not on derby (as we all recommend) the upgrade/migration aspect can be enormous. Even more so in a HAFO-setup. Regards, Pierre Op 20 april 2012 01:23