Building Password Purgatory with Cloudflare Pages and Workers

https://www.troyhunt.com/building-password-purgatory-with-cloudflare-pages-and-workers/

by robin_reala • 4 years ago

107 37 4 years ago

_nhynes• 4 years ago

You don’t need the bespoke Wrangler workflow now with Pages Functions [0]. Just drop the scripts in the `api/` directory in the page repo.

[0] https://developers.cloudflare.com/pages/platform/functions/

robertlagrant2• 4 years ago

I'm glad they're more combined now. It was annoying figuring out Pages and wrangler for web / functions respectively.

YPPH• 4 years ago

I always figured those SEO spammers sent bulk emails using automated or semi-automated tools. I have my doubts they will follow through on "registering" for one person's website.

rpicard• 4 years ago

Only one way to find out!

netsharc• 4 years ago

He should've done market research to see if the spammer would've even bitten.

MBCook• 4 years ago

You can find the in-progress list of checks in this source file:

https://github.com/troyhunt/password-purgatory-api/blob/mast...

It includes such gems as requiring the sum of all digits in the password to be divisible by 3, requiring passwords to contain Simpsons/Family Guy character names, emoticons, ending with “dog”, and all sorts of other craziness.

Can’t wait to see his results.

ssl2323• 4 years ago

Looking at the list I think it might be possible to pass all the tests (please correct me if I'm wrong). Maybe there needs to be a catch-all test that always fails?

petesergeant2• 4 years ago

“Sorry, another user in our system has that password”

ssl2323• 4 years ago

It lacks the most infuriating rule found in the wild, an upper limit on the length of the password (that's not at least in the thousands due to e.g. request size limits).

charcircuit• 4 years ago

Assuming an random alphanumeric password and a 256 bit hash there is no benefit going above a 55 character password. Even if you aren't just using random characters I think 100 is a fine limit. Most people are not going to be using a password that long without a password manager. If they are using a password manager they might as well just use a random password.

For there to be more security in allowing passwords thousands of digits long the host would very likely being storing your password in plain text as opposed to pulling out a few thousand bytes out of an XOF (extendable output function).

hayd• 4 years ago

even worse than the sum: "Password when stripped of non-numeric characters must be a number divisible by 3", considering it needs a valid zip and three digits of pi that starts to get non-trivial!

WayToDoor• 4 years ago

Can't you just add an extra number?

throwaway14356• 4 years ago

for forum spammers i made a super hard to read super long capcha "service" where every atempt is wrong.

yewenjie• 4 years ago

How do you make sure genuine users can use the forums?

passerby1• 4 years ago

Maybe today genuine users use facebook and reddit only? /sarcasm

systemvoltage2• 4 years ago

I wish Cloudflare supported Python for Workers/Functions. There is some weird translation from Python to Javascript which seems extremely bloated. I just want to run Python for the backend, natively. One day, we can deploy Flask apps through Cloudflare edge nodes, that would be cool.

robertlagrant2• 4 years ago

They only use the Chrome v8 engine to host their serverless stuff, so everything has to transpile to Javascript or compile to WASM. If v8 doesn't run it, it's not running in their edge.

I think it's a good idea; cheap runtimes and no cold start penalty are a good combination.

ekimekim• 4 years ago

One of the major reasons all these kinds of services use javascript is that it can be reliably sandboxed (it needs to be, so it can run in a browser without every random website getting control of your machine). While there's nothing in theory preventing you from doing a similar thing with python, an implementation with the same hardening just doesn't exist. CPython sandboxes have been broken over and over again, to the point that conventional wisdom is "the only way to sandbox python is to run it in a VM". The only other language I can think of offhand that has similar levels of sandboxing is Lua.

systemvoltage2• 4 years ago

How does AWS lambda work? From what I can see, it runs python natively.

https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes...

brody_hamer2• 4 years ago

Maybe fly.io?

I haven’t used them, but they do containers “on the edge”.

petesergeant2• 4 years ago

As a back-end developer, I was recently impressed by how quickly I was able to get up and running with Vercel, having started a vanilla JS project with Vite. Single change to my DNS records, and it's all setup at a custom domain in no time. If I was doing this project, I'd probably do it like that?

UPDATE: I'm procrastinating other projects. https://grou.ch (or https://passwordpurgatory.vercel.app/ if DNS hasn't propogated yet)

Times taken:

45s run vite

8m basic vanilla HTML scaffold

4.5m add some better password rules

1.75m setup in Bitbucket

1m Add to Vercel

1.5m setup custom domain

If I wanted to capture attempts, I'd probably do it via Google Analytics? It's magic to me how quick this tooling is -- just over 15m to get this up on the internet, https etc, domain, from literally nothing.

DoctorOW• 4 years ago

Vercel is very similar to Cloudflare Pages/Workers. I wouldn't really worry about one over the other.

rafaele• 4 years ago

Password must contain at least one tab character. Good one :)

ryan29• 4 years ago

I've never used Vercel, but skimming their site I think it's roughly the same concept as Cloudflare Pages / Functions.

SvelteKit has adapters [1] for both Cloudflare and Vercel (and Netlify), so they must be reasonably similar. I think Vite is a similar idea. I've never used it either, but have seen some references to Cloudflare deployment via a plugin.

The basic concept is really compelling IMO.

1. https://kit.svelte.dev/docs/adapters#supported-environments

gnyman• 4 years ago

In a similar spirit there is http://spa.mnesty.com and https://twitter.com/rescambot , the first one which is more simple and the second which has been discontinued.

Re:scam seemed quite good at what it did https://imgur.com/a/rrHi2

Does anyone know of any other service? I've had varying success with spamnesty , if I recall it does (or did) just have a list of non-answers it picked randomly from. While the Re:scam seemed to use some kind of ML to generate more relevant answers.

stavros2• 4 years ago

it does (or did) just have a list of non-answers it picked randomly from

Yes, this is true (I made Spamnesty). Lately the scammers have mostly stopped responding and just use bots, so it's all a list of bots replying to bots, and thus much less entertaining.

MichaelMoser123• 4 years ago

cloudlflare has an anti-ddos feature that makes it hard to scrap pages. This feature involves a number of http redirects, and at some stage they need to run javascript in order to get to the next step. The only fix was to scrap these pages was by means of automating the browser with selenium.

I was scrapping a big number of web pages for my project here https://github.com/mosermichael/duckduckbang Had to get the description of the sites used by duckduckgo bang operators, so i wrote my own scanning system too...

Building Password Purgatory with Cloudflare Pages and Workers

Related Stories