[clipperz] Clipperz login sometimes fails once, then succeeds
Steve Dee
I'll get a "Login failed" message. Generally this indicates that I've
mistyped my password, but I've found that usually if I just try again
with the same text in the password box, I can log in successfully.
First, it might make sense to have a separate "invalid password"
condition as opposed to other forms of login failure. Second, this is
probably a bug.
Seen in Chrome 6.0.401.1 on Linux.
--
You received this message because you are subscribed to the Google Groups "Clipperz" group.
To post to this group, send email to clip...@googlegroups.com.
To unsubscribe from this group, send email to clipperz+u...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/clipperz?hl=en.
giulio...@gmail.com
I have observed this same behavior, but I have always considered I
have miss typed the password.
There may be some strange condition preventing the login to succeed,
but I never had this problem once while running the tests, so I really
don't know how to investigate the problem.
For the error condition, due to the security choices we have put into
handling our users credentials, it is technically impossible for us to
understand if the problem is due to a wrong username or wrong
password. In any case, the server will provide the same answer
whatever problem it encounters, in order to avoid leaking useful
information to an attacker.
If you manage to identify the conditions when the problem arise, and
can reproduce it reliably, I would love to know! :)
Thanks for the feedback.
Regards,
Giulio Cesare
Kevin McGee (NetaisLLC)
I see this all the time using Chrome 4.1.249.blah on Windows7 64bit.
I used to think I was simple mistyping the passphrase since I have a
long one, but it seems to happen far too many times.
That said, simply *slowing down* and really concentrating on typing
accurately does seem to mitigate the issue.
Hmm, I wonder....
- Kevin M.
=======
On May 19, 11:16 am, "giulio.ces...@gmail.com"
> Hello Steve,
>
> I have observed this same behavior, but I have always considered I
> have miss typed the password.
>
> There may be some strange condition preventing the login to succeed,
> but I never had this problem once while running the tests, so I really
> don't know how to investigate the problem.
>
> For the error condition, due to the security choices we have put into
> handling our users credentials, it is technically impossible for us to
> understand if the problem is due to a wrong username or wrong
> password. In any case, the server will provide the same answer
> whatever problem it encounters, in order to avoid leaking useful
> information to an attacker.
>
> If you manage to identify the conditions when the problem arise, and
> can reproduce it reliably, I would love to know! :)
>
> Thanks for the feedback.
>
> Regards,
>
> Giulio Cesare
>
>
>
>
>
> > Pretty frequently, when I log in tohttps://www.clipperz.com/beta/,
> > mistyped my password, but I've found that usually if I just try again
> > with the same text in the password box, I can log in successfully.
> > First, it might make sense to have a separate "invalid password"
> > condition as opposed to other forms of login failure. Second, this is
> > probably a bug.
>
> > Seen in Chrome 6.0.401.1 on Linux.
>
> > --
> > You received this message because you are subscribed to the Google Groups "Clipperz" group.
> > To post to this group, send email to clip...@googlegroups.com.
> > To unsubscribe from this group, send email to clipperz+u...@googlegroups.com.
> --
> You received this message because you are subscribed to the Google Groups "Clipperz" group.
> To post to this group, send email to clip...@googlegroups.com.
> To unsubscribe from this group, send email to clipperz+u...@googlegroups.com.
giulio...@gmail.com
I had another 'private' notification on this same problem that could
be repeated.
All the report seems to be related to Chrome, Windows, and the /beta
version of Clipperz application.
Given the descriptions, it may happen that somehow the login procedure
starts before the randomness collector has enough entropy to safely
start SRP authentication. I don't know why only Chrome on Windows is
skipping this not waiting for this task to complete before starting
the actual login procedure.
If this is actually the case, you can easily avoid the problem simply
waiting a little bit (sorry, no actual indicator on when the procedure
is completed, other than a simple log into the Javascript console),
possibly moving the mouse steadily (the movement of the mouse helps
collecting entropy).
As this problem is an annoyance happening only on Chrome/Windows/beta,
we can hardly justify trying to fix it.
I feel very sorry for everybody involved, but I think you can
understand our desire to focus all our limited attention on trying to
complete the /gamma version.
Thanks everybody for the feedback.
Best regards,
Giulio Cesare
Steve Dee
bouktin
I noticed this problem using and I use chrome too, but can't really
reproduce it.
and I can't say it is linked to chrome.
If I ever figure out this behavior, I'll update this thread.
thomas
On 20 mai, 19:42, Steve Dee <mrdom...@gmail.com> wrote:
> It's definitely not just Windows -- I've seen it on Linux too. That said,
> it's still probably not an extraordinarily large portion of the userbase,
> and it doesn't render the app unusable -- it certainly makes more sense to
> focus on gamma.
>
> > .
> > >> You received this message because you are subscribed to the Google
> > Groups "Clipperz" group.
> > >> To post to this group, send email to clip...@googlegroups.com.
> > >> To unsubscribe from this group, send email to
> > .
> > > You received this message because you are subscribed to the Google Groups
> > "Clipperz" group.
> > > To post to this group, send email to clip...@googlegroups.com.
> > > To unsubscribe from this group, send email to
> > .
giulio...@gmail.com
if my diagnosis of the problem is correct, you should be able to
replicate it by re-loading the page, entering your credentials and
submit the login request before the entropy collector is ready to
generate random numbers.
If you look in the javascript console you should see this message:
> DEBUG: ### PRNG.readyToGenerateRandomBytes
My suspect is that if the login form is submitted before this log is
generated, it will fail. If submitted after, it will succeed.
Regards,
Giulio Cesare
giulio...@gmail.com
please make this test:
- quit and restart the browser;
- load Clipperz app, but don't try to login;
- open the javascript console (View -> Developer -> JavaScript Console);
- wait until the "DEBUG: ### PRNG.readyToGenerateRandomBytes" logs is
printed out;
- try to login.
If my suspect is correct, you will be able to login successfully.
Regards,
Giulio Cesare
On Tue, Jun 1, 2010 at 12:28 AM, thomas blanchard
<thomasfp....@gmail.com> wrote:
> Hello,
> actually, I tried it yesterday :
> after I restart my computer and start a new session of chrome, I typed my
> password in a blank text file, copied it to clipperz, and the first time it
> did not work, I tried another time and it worked.
> I tried this morning without restarting my os neither my browser and it
> worked on the first time.
> I have then restarted my browser and had an error while logging the first
> time. I did that several times (restart - login) and it failed each time. I
> tried reloading completely the page (with CTRL-SHIFT + R) but I still
> encounter troubles.
> I did not have any trouble with firefox nor IE, however I did not test them
> as much as chrome/
> could it be something with the way chrome manages the cache of some
> informations on the page ?
> like some script files (i don't know the program enough to answer).
>
> thomas
> 2010/5/31 giulio...@gmail.com <giulio...@gmail.com>
thomas blanchard
thomas blanchard
giulio...@gmail.com
thanks for the feedback.
I am not really in hurry to try to fix it (even because it seems to
affect only the /beta version, and not the new /gamma).
But I would love to understand what is going on anyway.
Thanks again for your support.
Regards,
Giulio Cesare
On Wed, Jun 2, 2010 at 12:05 AM, thomas blanchard
bouktin
I don't have the login problem anymore since a few days (week?) so I
suppose it was a bug from Chrome they have corrected in some version.
thanks for the support.
Regards,
thomas blanchard
On 2 juin, 09:05, "giulio.ces...@gmail.com" <giulio.ces...@gmail.com>
wrote:
> >> >> Hello Thomas,
>
> >> >> if my diagnosis of the problem is correct, you should be able to
> >> >> replicate it by re-loading the page, entering your credentials and
> >> >> submit the login request before the entropy collector is ready to
> >> >> generate random numbers.
>
> >> >> If you look in the javascript console you should see this message:
> >> >> > DEBUG: ### PRNG.readyToGenerateRandomBytes
>
> >> >> My suspect is that if the login form is submitted before this log is
> >> >> generated, it will fail. If submitted after, it will succeed.
>
> >> >> Regards,
>
> >> >> Giulio Cesare
>
> >> >> >> > .
> >> >> >> > >> > For more options, visit this group athttp://
> >> >> >> > groups.google.com/group/clipperz?hl=en.
>
> >> >> >> > >> --
> >> >> >> > >> You received this message because you are subscribed to the
> >> >> >> > Groups "Clipperz" group.
> >> >> >> > >> To post to this group, send email to clip...@googlegroups.com.
> >> >> >> > >> To unsubscribe from this group, send email to
>
> >> >> >> > .
> >> >> >> > >> For more options, visit this group athttp://
> >> >> >> > groups.google.com/group/clipperz?hl=en.
>
> >> >> >> > > --
> >> >> >> > > You received this message because you are subscribed to the
> >> >> >> > > Groups
> >> >> >> > "Clipperz" group.
> >> >> >> > > To post to this group, send email to
>
>
> plus de détails »
Jason Schmidt
David Given
[...]
> suppose it was a bug from Chrome they have corrected in some version.
(Is there an alpha?)
After upgrading to 7.0.499.0 (56633) Ubuntu 10.04, they both work
again.
Joel Riedesel
It wouldn't work with any of my saved data dumps either.
Failure with both beta and gamma of clipperz.
But under IE it still works.
Seems like a new Chrome feature?
> --
> You received this message because you are subscribed to the Google Groups "Clipperz" group.
> To post to this group, send email to clip...@googlegroups.com.
> To unsubscribe from this group, send email to clipperz+u...@googlegroups.com.
giulio...@gmail.com
this log is quite strange.
Clipperz has a multi-version authentication protocol; this was
designed to allow seamless upgrade of the authentication protocol in
case any vulnerability was ever found.
We have already upgraded the authentication protocol once (this was at
the VERY beginning of the development, probably even before we
released it publicly, and it was mostly done to verify the upgrade
procedure).
The application tries to authenticate using the latest version of the
protocol. If it fails it than fallback to the previous one, until the
bottom of the stack is reached; at that point a failure is notified to
the user.
When you enter a wrong username/passphrase, what you should see on the
logs looks more like this:
ERROR - c: 57d15a8afbc1ae08103bd991d387ddfd8d26824276476fe709d754f098b6c26d
# version: 0.2
ERROR - c: 78675cc176081372c43abab3ea9fb70c74381eb02dc6e93fb6d44d161da6eeb3
# version: 0.1
This means that the authentication using version 0.2 failed, and later
also version 0.1 failed.
In your logs, only the later is present, and this is VERY puzzling. :(
This probably means that the authentication using version 0.2 kind of
succeed, but probably failed in a point where it was not supposed to
fail.
Do you have this same problem also running the /gamma version of the
application?
/gamma has a more sophisticated logging code that could provide a few
more hints at what is going on.
Thanks for the feedback.
Regards,
Giulio Cesare