Re: [PHP] Re: Do you trim() usernames and passwords?

2011-01-04 Thread tedd
At 12:04 PM + 12/31/10, Nathan Rixham wrote: Tamara Temple wrote: Sorry, I was mislead by your use of the phrase Users should not be copy-pasting passwords or usernames above. I'd love to hear what you think is an alternative to identifying with web app that keeps track of information

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-31 Thread Nathan Rixham
Tamara Temple wrote: On Dec 28, 2010, at 2:11 PM, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and passwords coping and pasting leading and trailing space characters. Users should not be copy-pasting passwords or

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-31 Thread Nathan Rixham
Tamara Temple wrote: Sorry, I was mislead by your use of the phrase Users should not be copy-pasting passwords or usernames above. I'd love to hear what you think is an alternative to identifying with web app that keeps track of information about someone that is more secure. client side ssl

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Dotan Cohen
On Thu, Dec 30, 2010 at 03:05, Nicholas Kell n...@monkeyknight.com wrote: Even funnier yet - bottom post like you were asked. And to really bust your gut, this thread has gone on far too long off topic. I believe that the person you are referring to as Dani, is in fact Daniel. I don't, nor

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Paul M Foster
On Wed, Dec 29, 2010 at 05:32:38PM -0500, Daniel P. Brown wrote: On Wed, Dec 29, 2010 at 15:16, Omega -1911 1911...@gmail.com wrote: Sound silly? Why Daniel? It's all documented and public knowledge. What I thought was silly was a entire thread about which ASCII combination was best..

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Paul M Foster
On Wed, Dec 29, 2010 at 08:27:49PM -0500, Mujtaba Arshad wrote: craphound.com/images/xkcdwrongoninternet.jpg And this is why I love XKCD. LOL. Paul -- Paul M. Foster http://noferblatz.com -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Ashley Sheridan
On Thu, 2010-12-30 at 11:04 -0500, Paul M Foster wrote: On Wed, Dec 29, 2010 at 08:27:49PM -0500, Mujtaba Arshad wrote: craphound.com/images/xkcdwrongoninternet.jpg And this is why I love XKCD. LOL. Paul -- Paul M. Foster http://noferblatz.com It's got a comic for pretty

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Paul M Foster
On Wed, Dec 29, 2010 at 06:52:28PM -0500, TR Shaw wrote: [snip] So now lets look at the case where there is malware on your machine which will try to brute force your computationally hard password and is smart enough to use your graphics engine to increased computational power. Folks at

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Omega -1911
I'm pretty sure there is a lot that happened that has not been mentioned yet ;) But I digress... it's all came down to no one being able to contradict my post. If u consider an attempt to get personal a defense, I would hope that in a real world scenario, u have a better tactic.

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Ashley Sheridan
On Thu, 2010-12-30 at 11:19 -0500, Omega -1911 wrote: I'm pretty sure there is a lot that happened that has not been mentioned yet ;) But I digress... it's all came down to no one being able to contradict my post. If u consider an attempt to get personal a defense, I would hope that in a

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Omega -1911
Which topic ashley do u wish to discuss. With the eccouncil.org being in your neck of th woods, learning/reading what hackers are using/doing shouldn't be hard... On Dec 30, 2010 11:23 AM, Ashley Sheridan a...@ashleysheridan.co.uk wrote: On Thu, 2010-12-30 at 11:19 -0500, Omega -1911 wrote: I'm

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Daniel P. Brown
On Thu, Dec 30, 2010 at 11:27, Omega -1911 1911...@gmail.com wrote: Which topic ashley do u wish to discuss. With the eccouncil.org being in your neck of th woods, learning/reading what hackers are using/doing shouldn't be hard... Really, this entire thing has gone on for far too long.

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Ashley Sheridan
On Thu, 2010-12-30 at 11:27 -0500, Omega -1911 wrote: Which topic ashley do u wish to discuss. With the eccouncil.org being in your neck of th woods, learning/reading what hackers are using/doing shouldn't be hard... On Dec 30, 2010 11:23 AM, Ashley Sheridan a...@ashleysheridan.co.uk wrote:

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Omega -1911
Wont mind doing once I get home. You should study the council. The base of a company does not mean they don't have branches. If you read past the first page, you would understand... joint council... does microsoft have an office there ;). What's your site again... interested. On a cell right now,

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Tamara Temple
On Dec 28, 2010, at 2:11 PM, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and passwords coping and pasting leading and trailing space characters. Users should not be copy-pasting passwords or usernames. Do not

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Tamara Temple
On Dec 28, 2010, at 10:28 PM, Joshua Kehn wrote: On Dec 28, 2010, at 6:28 PM, Paul M Foster wrote: On Tue, Dec 28, 2010 at 03:11:56PM -0500, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and passwords coping and

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Mujtaba Arshad
Won't there also be a higher chance of getting your username/password combination stolen if you are keylogged, if you are typing in your passwords all day everyday? Obviously, the people on this list will say I don't get keylogged, cause I am that pro but whatever, just don't force people to enter

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Joshua Kehn
On Dec 31, 2010, at 1:26 AM, Tamara Temple wrote: On Dec 28, 2010, at 2:11 PM, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and passwords coping and pasting leading and trailing space characters. Users should

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Joshua Kehn
On Dec 31, 2010, at 1:31 AM, Tamara Temple wrote: On Dec 28, 2010, at 10:28 PM, Joshua Kehn wrote: On Dec 28, 2010, at 6:28 PM, Paul M Foster wrote: On Tue, Dec 28, 2010 at 03:11:56PM -0500, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Tamara Temple
On Dec 29, 2010, at 7:27 PM, Mujtaba Arshad wrote: craphound.com/images/xkcdwrongoninternet.jpg Least you could do is give Randall the love, instead of Cory :) http://xkcd.com/386/ -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Tamara Temple
On Dec 31, 2010, at 12:41 AM, Joshua Kehn wrote: On Dec 31, 2010, at 1:26 AM, Tamara Temple wrote: On Dec 28, 2010, at 2:11 PM, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and passwords coping and pasting

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Tamara Temple
On Dec 31, 2010, at 12:41 AM, Joshua Kehn wrote: On Dec 31, 2010, at 1:31 AM, Tamara Temple wrote: 20? child's play. How about 250+ randomly generated passwords and username combinations? Why do you randomly generate 250+ usernames and passwords?? I generate unique pairs for the various

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-30 Thread Tamara Temple
On Dec 31, 2010, at 12:37 AM, Mujtaba Arshad wrote: Won't there also be a higher chance of getting your username/ password combination stolen if you are keylogged, if you are typing in your passwords all day everyday? Obviously, the people on this list will say I don't get keylogged, cause

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Dotan Cohen
On Wed, Dec 29, 2010 at 02:46, David Harkness davi...@highgearmedia.com wrote: To address the OP, I would agree with skipping trim on both the user name and password. If it's a copy-paste error, they will try again. They do try again: copying and pasting in the exact same manner. It keeps

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Dotan Cohen
On Wed, Dec 29, 2010 at 06:51, Paul M Foster pa...@quillandmouse.com wrote: I agree that users should not use weak passwords, but not everyone goes everywhere with a vault. I am more then capable of memorizing 20 or so 16-32 character full set passwords. And so you assume everyone can do

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Dotan Cohen
On Wed, Dec 29, 2010 at 07:00, David Hutto smokefl...@gmail.com wrote: Correct me if I'm wrong, but If you initially type the username and password into a file, and you have, in my paranoid scenario, a keylogger you don't know about, it get's logged, but also, i assume it would get logged if

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Omega -1911
Well, let's see. My system sits behind a firewall. No external services are advertised to the internet. All internal addresses are non-routable. I do not use or have any wifi. The system sits in my home office. I use a Debian Linux system and practice very safe computing. I often investigate

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Dotan Cohen
On Wed, Dec 29, 2010 at 11:20, Omega -1911 1911...@gmail.com wrote: Hi Paul - I am interested in knowing how you prevent intrusion with your firewall when it is a known fact that post 9/11 companies that develop such leave ports open for Big Brother as required. Remember Green Lantern,

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Omega -1911
Hi Doran - that may partially work, but what happens on the site's level? If the site is hacked, millions of passwords are stolen. All of the hard work put forth to protect your pc becomes useless. I think it has to be a two way street ... On a shared host, security and the ability to capture

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Paul M Foster
On Wed, Dec 29, 2010 at 04:20:58AM -0500, Omega -1911 wrote: Well, let's see. My system sits behind a firewall. No external services are advertised to the internet. All internal addresses are non-routable. I do not use or have any wifi. The system sits in my home office. I use a Debian

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Paul M Foster
On Wed, Dec 29, 2010 at 11:06:15AM +0200, Dotan Cohen wrote: On Wed, Dec 29, 2010 at 06:51, Paul M Foster pa...@quillandmouse.com wrote: snip Under the circumstances I described, I have yet to hear in what way copying and pasting passwords compromises security of anything by itself.

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Nicholas Kell
On Dec 29, 2010, at 10:40 AM, Paul M Foster wrote: On Wed, Dec 29, 2010 at 11:06:15AM +0200, Dotan Cohen wrote: On Wed, Dec 29, 2010 at 06:51, Paul M Foster pa...@quillandmouse.com wrote: snip Under the circumstances I described, I have yet to hear in what way copying and pasting

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Omega -1911
Those were some pretty confident statements there. You doubt the government would want to hack your computer... Well, the U.S. tries to prevent over 1 million attacks per day as documented and has admitted to having been breached more often than not... !!! But as someone who let's just say has

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread tedd
At 4:06 PM -0500 12/28/10, Daniel Brown wrote: On Tue, Dec 28, 2010 at 16:05, Dotan Cohen dotanco...@gmail.com wrote: Did you know that when you type 'brown1' we see it as **? Your system does that automatically. That's how I see it, too. It took me fourteen years to realize that

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread tedd
At 11:06 AM +0200 12/29/10, Dotan Cohen wrote: Also, change them {passwords} frequently. I've always wondered about that -- if your password works, then why change it? Where's the logic in that? From my perspective, it looks like Hey, the crackers have not been able to crack this, so let's

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread tedd
At 11:57 AM -0500 12/29/10, Omega -1911 wrote: Why not store passwords inside of programs like snow? Maybe yellow snow, but never in something permanent. My advice -- memorize your passwords -- don't commit them to storage. I have a list of passwords committed to memory that fall into three

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Joshua Kehn
On Dec 29, 2010, at 12:37 PM, tedd wrote: At 11:06 AM +0200 12/29/10, Dotan Cohen wrote: Also, change them {passwords} frequently. I've always wondered about that -- if your password works, then why change it? Where's the logic in that? From my perspective, it looks like Hey, the

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Daniel P. Brown
On Wed, Dec 29, 2010 at 11:57, Omega -1911 1911...@gmail.com wrote: Those were some pretty confident statements there. You doubt the government would want to hack your computer... Well, the U.S. tries to prevent over 1 million attacks per day as documented and has admitted to having been

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Omega -1911
Sound silly? Why Daniel? It's all documented and public knowledge. What I thought was silly was a entire thread about which ASCII combination was best.. convert to a higher range above the 255 character range... There is NOTHING I have mentioned that you or anyone can call a lie. Google or

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Daniel P. Brown
On Wed, Dec 29, 2010 at 15:16, Omega -1911 1911...@gmail.com wrote: Sound silly? Why Daniel? It's all documented and public knowledge. What I thought was silly was a entire thread about which ASCII combination was best.. convert to a higher range above the 255 character range... There is

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Omega -1911
AHHH... Searching by by an email is REALLY what you call hacking? Oh wait, you said that with all your knowledge in forensics you can find people all over the world. Thank God for Go0GlE. (remoteclerk.com) c-174-59-179-206.hsd1.pa.comcast.net - - [29/Dec/2010:10:19:50 -0800] GET

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Daniel P. Brown
On Wed, Dec 29, 2010 at 18:20, Omega -1911 1911...@gmail.com wrote: AHHH... Searching by by an email is REALLY what you call hacking? Oh wait, you said that with all your knowledge in forensics you can find people all over the world. Thank God for Go0GlE. Please don't top-post. Never

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Mujtaba Arshad
Quote: I was pleased earlier, however, to learn about your interest in helping others by creating a venue for them to sell their own homemade pornographic DVDs at such a low price, but then disappointed to learn that your grasp of Perl and site management wasn't yet up to par. Lol what. On

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Omega -1911
Etiquette went out the window a while ago. As Rambo said, He drew first blood... If you could not PROVE ME WRONG, you could have kept your mouth shut. You jumped in head first. And you have YET to prove me wrong. Then to throw off the subject, you resort to telling the world who you believe I

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Daniel P. Brown
On Wed, Dec 29, 2010 at 18:38, Omega -1911 1911...@gmail.com wrote: Etiquette went out the window a while ago. As Rambo said, He drew first blood... If you could not PROVE ME WRONG, you could have kept your mouth shut. You jumped in head first. And you have YET to prove me wrong. Then to throw

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread TR Shaw
On Dec 29, 2010, at 12:56 PM, Joshua Kehn wrote: On Dec 29, 2010, at 12:37 PM, tedd wrote: At 11:06 AM +0200 12/29/10, Dotan Cohen wrote: Also, change them {passwords} frequently. I've always wondered about that -- if your password works, then why change it? Where's the logic in that?

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Bastien
On 2010-12-29, at 5:32 PM, Daniel P. Brown daniel.br...@parasane.net wrote: On Wed, Dec 29, 2010 at 15:16, Omega -1911 1911...@gmail.com wrote: Sound silly? Why Daniel? It's all documented and public knowledge. What I thought was silly was a entire thread about which ASCII combination was

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Omega -1911
I know something funnier... Let's wait for Dani's response. On Wed, Dec 29, 2010 at 7:28 PM, Bastien phps...@gmail.com wrote: On 2010-12-29, at 5:32 PM, Daniel P. Brown daniel.br...@parasane.net wrote: On Wed, Dec 29, 2010 at 15:16, Omega -1911 1911...@gmail.com wrote: Sound silly? Why

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Joshua Kehn
On Dec 29, 2010, at 6:52 PM, TR Shaw wrote: On Dec 29, 2010, at 12:56 PM, Joshua Kehn wrote: On Dec 29, 2010, at 12:37 PM, tedd wrote: At 11:06 AM +0200 12/29/10, Dotan Cohen wrote: Also, change them {passwords} frequently. I've always wondered about that -- if your password works,

Fwd: Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Alexis
What has any of this got to do with PHP!!! If the moderator is reading this can they please out a stop to it at once, as it appears to have got way out of control. Thanks and a Happy New year to one and all On 29/12/10 16:38, Omega -1911 wrote: Etiquette went out the window a while ago.

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Nicholas Kell
On Dec 29, 2010, at 6:37 PM, Omega -1911 wrote: I know something funnier... Let's wait for Dani's response. On Wed, Dec 29, 2010 at 7:28 PM, Bastien phps...@gmail.com wrote: On 2010-12-29, at 5:32 PM, Daniel P. Brown daniel.br...@parasane.net wrote: On Wed, Dec 29, 2010 at 15:16,

Re: Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Daniel Brown
On Wed, Dec 29, 2010 at 20:04, Alexis phplis...@antonakis.co.uk wrote: What has any of this got to do with PHP!!! If the moderator is reading this can they please out a stop to it at once, as it appears to have got way out of control. Thanks and a Happy New year to one and all What

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Omega -1911
I see you Waving your pom poms... I guess it was ok for Dani to say I'm just not sure if it's pronounced with a J or an H sound. I mean, Arthur's name is easy enough, but I honestly am confused by Javen's (except when he spells it out like James Vencent). First, that is assuming a lot... on

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-29 Thread Mujtaba Arshad
craphound.com/images/xkcdwrongoninternet.jpg Perfect way to describe how the members on this list are behaving right now. On Wed, Dec 29, 2010 at 8:17 PM, Omega -1911 1911...@gmail.com wrote: I see you Waving your pom poms... I guess it was ok for Dani to say I'm just not sure if it's

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Dotan Cohen
On Tue, Dec 28, 2010 at 15:27, Al n...@ridersite.org wrote: Can't you simply specify the allowed characters that can be used for PWs and usernames? No, I hate when websites do that. It leads to less secure passwords, not more secure, and it is passing the burden of fixing the issue onto the

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Nathan Rixham
Joshua Kehn wrote: Trim usernames but not passwords. agree. nice catch, I was thinking about passwords specifically and forgot usernames was in the topic too! On Dec 28, 2010, at 2:57 PM, Nathan Rixham wrote: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and passwords coping and pasting leading and trailing space characters. Users should not be copy-pasting passwords or usernames. Do not compromise a system to cater to bad [stupid, ignorant,

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Dotan Cohen
On Tue, Dec 28, 2010 at 22:02, Joshua Kehn josh.k...@gmail.com wrote: Trim usernames but not passwords. Some people put spaces at the beginning and end of their passwords. Double confirm and don't mess with the input otherwise they tend to get confused. How about: if ($trimmedUsername !=

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
Trim usernames but not passwords. Some people put spaces at the beginning and end of their passwords. Double confirm and don't mess with the input otherwise they tend to get confused. Regards, -Josh Joshua Kehn | josh.k...@gmail.com http://joshuakehn.com

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Peter Lind
On 28 December 2010 21:18, Dotan Cohen dotanco...@gmail.com wrote: On Tue, Dec 28, 2010 at 21:57, Nathan Rixham nrix...@gmail.com wrote: Don't trim or limit the range of input characters, but far more importantly /don't send passwords in clear text/, indeed don't generate passwords at all, let

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Dotan Cohen
On Tue, Dec 28, 2010 at 22:11, Joshua Kehn josh.k...@gmail.com wrote: Users should not be copy-pasting passwords or usernames. Do not compromise a system to cater to bad [stupid, ignorant, you pick] users. If this is an issue then educate the users. Educate the users?!? Is that like making

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
On Dec 28, 2010, at 3:18 PM, Dotan Cohen wrote: I'm toying with the idea of having the passwords hashed twice: they're already in the database hashed, and javascript hashes them on the client before sending them over, but I'm thinking about sending an additional salt to the client to hash the

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Dotan Cohen
On Tue, Dec 28, 2010 at 22:23, Peter Lind peter.e.l...@gmail.com wrote: Sounds like https would be MUCH simpler and likely as safe or safer. I wouldn't waste my time on trying to come up with very clever schemes when tried and true technologies are out there. You are right, I know. But

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Nicholas Kell
On Dec 28, 2010, at 2:11 PM, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and passwords coping and pasting leading and trailing space characters. Users should not be copy-pasting passwords or usernames. Do not

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
On Dec 28, 2010, at 3:23 PM, Dotan Cohen wrote: On Tue, Dec 28, 2010 at 22:02, Joshua Kehn josh.k...@gmail.com wrote: Trim usernames but not passwords. Some people put spaces at the beginning and end of their passwords. Double confirm and don't mess with the input otherwise they tend to get

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Nathan Rixham
Joshua Kehn wrote: On Dec 28, 2010, at 3:18 PM, Dotan Cohen wrote: I'm toying with the idea of having the passwords hashed twice: they're already in the database hashed, and javascript hashes them on the client before sending them over, but I'm thinking about sending an additional salt to the

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Dotan Cohen
On Tue, Dec 28, 2010 at 22:26, Joshua Kehn josh.k...@gmail.com wrote: Educate the users, don't compromise the system. Either go full on and trim everything (I don't recommend this) or trim nothing. Be consistent in which one you pick. Then how about: if ($trimmedPassword==$realPassword

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
On Dec 28, 2010, at 3:29 PM, Nathan Rixham wrote: Joshua Kehn wrote: On Dec 28, 2010, at 3:18 PM, Dotan Cohen wrote: I'm toying with the idea of having the passwords hashed twice: they're already in the database hashed, and javascript hashes them on the client before sending them over, but

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
On Dec 28, 2010, at 3:26 PM, Nicholas Kell wrote: If you work for a company that admins over a hundred websites, you may be inclined to copy-paste a few passwords. I don't know about you, but when we use passwords that are over 16 characters long and I don't want to get an incorrect

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Dotan Cohen
On Tue, Dec 28, 2010 at 22:30, Joshua Kehn josh.k...@gmail.com wrote: indeed, and on reflection, if you're putting this much effort in to it, and security is a worry, then forget username and passwords, and issue each user with a client side RSA v3 certificate and identify them via the public

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
On Dec 28, 2010, at 3:32 PM, Dotan Cohen wrote: On Tue, Dec 28, 2010 at 22:30, Joshua Kehn josh.k...@gmail.com wrote: indeed, and on reflection, if you're putting this much effort in to it, and security is a worry, then forget username and passwords, and issue each user with a client side RSA

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Nathan Rixham
Dotan Cohen wrote: On Tue, Dec 28, 2010 at 22:30, Joshua Kehn josh.k...@gmail.com wrote: indeed, and on reflection, if you're putting this much effort in to it, and security is a worry, then forget username and passwords, and issue each user with a client side RSA v3 certificate and identify

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
On Dec 28, 2010, at 3:24 PM, Dotan Cohen wrote: On Tue, Dec 28, 2010 at 22:11, Joshua Kehn josh.k...@gmail.com wrote: Users should not be copy-pasting passwords or usernames. Do not compromise a system to cater to bad [stupid, ignorant, you pick] users. If this is an issue then educate the

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Dotan Cohen
On Tue, Dec 28, 2010 at 22:52, Joshua Kehn josh.k...@gmail.com wrote: We're PHP programmers, we do the impossible all the time. Without automatic migrations, managed models, succinct ORM's. Other developers look at us in shock as we memorize the $haystack and $needle argument orders for

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Dotan Cohen
On Tue, Dec 28, 2010 at 22:43, Nathan Rixham nrix...@gmail.com wrote: that's what pkcs12 was invented for, just issue another certificate / key pair. I could probably automate and script it, I would just give the users a name/password combo to their own control panel... -- Dotan Cohen

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Dotan Cohen
On Tue, Dec 28, 2010 at 23:02, Daniel Brown danbr...@php.net wrote:    This thread has really just gone on far too long without the only correct answer: always use the same username/password for everything, and always make them as simple as possible so that you can remember them.  For example,

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Daniel Brown
On Tue, Dec 28, 2010 at 16:05, Dotan Cohen dotanco...@gmail.com wrote: Did you know that when you type 'brown1' we see it as **? Your system does that automatically. That's how I see it, too. It took me fourteen years to realize that my password wasn't just six asterisks (though, in

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Peter Lind
On 28 December 2010 22:06, Daniel Brown danbr...@php.net wrote: On Tue, Dec 28, 2010 at 16:05, Dotan Cohen dotanco...@gmail.com wrote: Did you know that when you type 'brown1' we see it as **? Your system does that automatically.    That's how I see it, too.  It took me fourteen years to

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Daniel Brown
On Tue, Dec 28, 2010 at 16:10, Peter Lind peter.e.l...@gmail.com wrote: Bla bla bla not Friday yet bla bla bla cut down on the noise on the list bla bla I tend to think that you fail to see the actual meaning behind the messages, Peter, and instead just like to remind me of my own words.

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Paul M Foster
On Tue, Dec 28, 2010 at 03:11:56PM -0500, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and passwords coping and pasting leading and trailing space characters. Users should not be copy-pasting passwords or

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread David Harkness
On Tue, Dec 28, 2010 at 3:28 PM, Paul M Foster pa...@quillandmouse.comwrote: Users would be wise to follow a scheme like this, rather than using their dog's name or somesuch as their passwords. Aww man, I've been using somesuch as the password for all my accounts and now you've ruined it!

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
On Dec 28, 2010, at 6:28 PM, Paul M Foster wrote: On Tue, Dec 28, 2010 at 03:11:56PM -0500, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and passwords coping and pasting leading and trailing space characters.

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Paul M Foster
On Tue, Dec 28, 2010 at 11:28:12PM -0500, Joshua Kehn wrote: On Dec 28, 2010, at 6:28 PM, Paul M Foster wrote: On Tue, Dec 28, 2010 at 03:11:56PM -0500, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue with users who copy-paste their usernames and

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Joshua Kehn
On Dec 28, 2010, at 11:51 PM, Paul M Foster wrote: On Tue, Dec 28, 2010 at 11:28:12PM -0500, Joshua Kehn wrote: On Dec 28, 2010, at 6:28 PM, Paul M Foster wrote: On Tue, Dec 28, 2010 at 03:11:56PM -0500, Joshua Kehn wrote: Specifically: Dotan Cohen wrote: I seem to have an issue

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread David Hutto
On Tue, Dec 28, 2010 at 11:51 PM, Paul M Foster pa...@quillandmouse.com wrote: On Tue, Dec 28, 2010 at 11:28:12PM -0500, Joshua Kehn wrote: On Dec 28, 2010, at 6:28 PM, Paul M Foster wrote: On Tue, Dec 28, 2010 at 03:11:56PM -0500, Joshua Kehn wrote: Specifically: Dotan Cohen wrote:

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread Paul M Foster
On Wed, Dec 29, 2010 at 12:00:01AM -0500, David Hutto wrote: On Tue, Dec 28, 2010 at 11:51 PM, Paul M Foster pa...@quillandmouse.com wrote: On Tue, Dec 28, 2010 at 11:28:12PM -0500, Joshua Kehn wrote: On Dec 28, 2010, at 6:28 PM, Paul M Foster wrote: On Tue, Dec 28, 2010 at

Re: [PHP] Re: Do you trim() usernames and passwords?

2010-12-28 Thread David Hutto
It would seem that with in the streaming of information that moves across networks, that such things as virus detection within these networks(meaning governmental oversite of info...post 9/11), which, if I'm not mistaken is regexing for matching strings of definitions, are checked for as they