[9front] Password confirmation in auth/wrkey

[9front] Password confirmation in auth/wrkey

[Vadim Kotov]

Hey folks,

I was wondering if there is a reason there is no password confirmation prompt when writing to nvram using auth/wrkey?

Cheers,
Vadím 

Re: [9front] Password confirmation in auth/wrkey

[Jacob Moody]

On 8/23/23 17:10, Vadim Kotov wrote:
> Hey folks,
> 
> I was wondering if there is a reason there is no password confirmation prompt when writing to nvram using auth/wrkey?
> 
> Cheers,
> Vadím 


I see no real reason other then that no one has bothered.
Looking at the code it calls in libauthsrv, you could get away with
just calling readcons() a second time and making sure they match.

Re: [9front] Password confirmation in auth/wrkey

[Jacob Moody]

On 8/23/23 17:42, Jacob Moody wrote:
> On 8/23/23 17:10, Vadim Kotov wrote:
>> Hey folks,
>>
>> I was wondering if there is a reason there is no password confirmation prompt when writing to nvram using auth/wrkey?
>>
>> Cheers,
>> Vadím 
> 
> 
> I see no real reason other then that no one has bothered.
> Looking at the code it calls in libauthsrv, you could get away with
> just calling readcons() a second time and making sure they match.
> 

Tested this out. I asked around on the grid and the general consensus
was in favor.

diff 483ff27f9d5067fd597dae09161d07a3857293b6 uncommitted
--- a//sys/src/libauthsrv/readnvram.c
+++ b//sys/src/libauthsrv/readnvram.c
@@ -247,6 +247,7 @@
 	if((flag&(NVwrite|NVwritemem)) || (err && (flag&NVwriteonerr))){
 		if (!(flag&NVwritemem)) {
 			char pass[PASSWDLEN];
+			char pass2[PASSWDLEN];
 			Authkey k;

 			if(ask("authid", safe->authid, sizeof safe->authid, 0))
@@ -255,12 +256,20 @@
 				goto Out;
 			if(ask("secstore key", safe->config, sizeof safe->config, 1))
 				goto Out;
+Again:
 			if(ask("password", pass, sizeof pass, 1))
 				goto Out;
+			if(ask("confirm password", pass2, sizeof pass2, 1))
+				goto Out;
+			if(memcmp(pass, pass2, sizeof pass) != 0){
+				fprint(2, "password mismatch\n");
+				goto Again;
+			}
 			if((dodes = readcons("enable legacy p9sk1", "no", 0)) == nil)
 				goto Out;
 			passtokey(&k, pass);
 			memset(pass, 0, sizeof pass);
+			memset(pass2, 0, sizeof pass2);
 			if(dodes[0] == 'y' || dodes[0] == 'Y')
 				memmove(safe->machkey, k.des, DESKEYLEN);
 			else

Re: [9front] Password confirmation in auth/wrkey

[ieliedonge]

> Tested this out. I asked around on the grid and the general consensus
> was in favor.

Dead simple. Nice. Dumb, noob question, but what is "the grid" here?

Re: [9front] Password confirmation in auth/wrkey

[Jacob Moody]

On 8/24/23 21:58, ieliedonge@wilsonb.com wrote:
>> Tested this out. I asked around on the grid and the general consensus
>> was in favor.
> 
> Dead simple. Nice. Dumb, noob question, but what is "the grid" here?

The grid is a collective of 9p services. perhaps most notably a chat.
Due to recent influx of attention on this list and recent trolling in our chat I
am apprehensive to provide direct links.

Re: [9front] Password confirmation in auth/wrkey

[ieliedonge]

> The grid is a collective of 9p services. perhaps most notably a chat.
> Due to recent influx of attention on this list and recent trolling in our chat I
> am apprehensive to provide direct links.

Cheers. That's probably enough for me to find the necessary details.

Re: [9front] Password confirmation in auth/wrkey

[cinap_lenrek]

probably a good idea to use tsmemcmp() here
instead of memcmp().

make sure that the fqa also gets updated.

--
cinap

Re: [9front] Password confirmation in auth/wrkey

[Jacob Moody]

On 8/27/23 14:42, cinap_lenrek@felloff.net wrote:
> probably a good idea to use tsmemcmp() here
> instead of memcmp().
> 
> make sure that the fqa also gets updated.

Made the memcmp -> tsmemcmp change and sent
fqa updates over to sl.

Thanks!
moody

Re: [9front] Password confirmation in auth/wrkey

[Vadim Kotov]

Thank you for the response and the patch Jacob!


Aug 23, 2023, 15:46 by moody@posixcafe.org:

> On 8/23/23 17:10, Vadim Kotov wrote:
>
>> Hey folks,
>>
>> I was wondering if there is a reason there is no password confirmation prompt when writing to nvram using auth/wrkey?
>>
>> Cheers,
>> Vadím 
>>
>
>
> I see no real reason other then that no one has bothered.
> Looking at the code it calls in libauthsrv, you could get away with
> just calling readcons() a second time and making sure they match.
>