- Pharo-users - lists.pharo.org

FUEL documentation
by Juraj Kubelka June 30, 2017

June 30, 2017

Hi, Is there any documentation about FUEL? I would like to understand in more detail what data -- Juraj Kubelka

1 0

[ANN] An evening with Pharo and the ESP32 microcontroller
by Ben Coman June 30, 2017

June 30, 2017

Nothing too dramatic, but for a hardware hackathon I'm attending I wanted some online material I could expose to people to who hadn't heard of Pharo before. Maybe some Pharo regulars might also find it of interest. All comments welcome. http://blog.openinworld.com/2017/06/evening-with-pharo-esp32/ cheers -ben

2 2

Re: [Pharo-users] Validate password with PBKDF2
by Erik Stel June 30, 2017

June 30, 2017

Francis, The hashpw function returns a hash with the salt prepended. So it contains both elements. (See for example explanation at: https://stackoverflow.com/questions/27413248/why-can-bcrypt-hashpw-be-used-…) You can do the same thing here. Assuming you have a fixed size salt, just prepend it before the hash value. Since the salt is (should be) random, returning it's value does not weaken the security. Using a salt prevents against rainbow table attacks: pre-generated hash values for many possible passwords. (See https://en.wikipedia.org/wiki/Rainbow_table) Cheers, Erik -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973p4953067.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

2 1

Re: [Pharo-users] Validate password with PBKDF2
by HernÃ¡n Morales Durand June 30, 2017

June 30, 2017

I guess I could integrate Udo's PBKDF2 into ApplicationSecurity. See under "Using the CheckPoint" if matches your API you're looking for: http://80738163270632.blogspot.com.ar/2014/10/application-security-2-checkp… Cheers, HernÃ¡n 2017-06-30 4:43 GMT-03:00 Francis via Pharo-users < pharo-users(a)lists.pharo.org>: > > > ---------- Mensaje reenviado ---------- > From: Francis <falzonidavide(a)libero.it> > To: pharo-users(a)lists.pharo.org > Cc: > Bcc: > Date: Fri, 30 Jun 2017 00:43:23 -0700 (PDT) > Subject: Re: Validate password with PBKDF2 > Thank you Paul, > Saving the salt is not a big issue but I'd like something more simple. > In python I can store the salt with the password > see:https://pypi.python.org/pypi/bcrypt/3.1.0 > > # Hash a password for the first time, with a randomly-generated salt > hashed = bcrypt.hashpw(password, bcrypt.gensalt()) > > and retrieve it subsequently > if bcrypt.checkpw(password, hashed): > ... print("It Matches!") > > Are you (smalltalkers) aware of something similar? > > Thanks again > Francis > > > > Paul DeBruicker wrote > > Looks like you'll have to store the salt when making the original hash of > > the password. > > > > With that you can do > > > > > > | salt originalPassword userInputPassword originalHash newHash secretKey > > | > > salt:='salt'. > > originalPassword:='password'. > > userInputPassword:='12345678'. > > originalHash:=PBKDF2 derivedKeySHA1Password: originalPassword salt: salt. > > newHash:=PBKDF2 derivedKeySHA1Password: userInputPassword salt: salt. > > > > secretKey:= SecureRandom new nextBytes: 16. > > > > ((SHA256 new hmac key: secretKey) digestMessage: originalHash) = ((SHA256 > > new hmac key: secretKey) digestMessage: newHash). > > > > > > > > We do the double SHA256 HMAC signing of the hashes because of > > https://www.nccgroup.trust/us/about-us/newsroom-and-events/ > blog/2011/february/double-hmac-verification/ > > > > You can store the #secretKey and each user should get a new #salt every > > time they change their password and you shouldn't reuse the salts for > > other users or password. > > > > For PBKDF2 there is probably a max (or recommended) salt length but I > > don't know it. > > > > I also don't know anything about the SecureRandom class but it says it on > > the tin, so maybe it is. Maybe not though. I don't know how to find > out. > > But I don't know that it matters in this instance as its only used for > the > > SHA256 HMAC internally in the comparison function. > > > > > > Hope this helps. > > > > > > Francis wrote > >> Hi folks > >> > >> I'm playing with the PBKDF2 package of Udo: > >> http://www.smalltalkhub.com/#!/~UdoSchneider/PBKDF2 > >> (thanks Udo), but I can't find how to validate a stored hash. > >> Can you point me in the right direction? > >> > >> Thanks > >> Francis > > > > > > -- > View this message in context: http://forum.world.st/ > Validate-password-with-PBKDF2-tp4952973p4953004.html > Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com. > > >

1 0

Logging in with VNC
by sergio ruiz June 30, 2017

June 30, 2017

Hey, all.. I need to be able to log in to my production image with VNC until i am comfortable with the command line interface. I know that every time i have had to do it, it seems like i used a different package. Which package is everyone using these days for remote GUI access? Thanks! ---- peace, sergio photographer, journalist, visionary Public Key:Â http://bit.ly/29z9fG0 #BitMessageÂ BM-NBaswViL21xqgg9STRJjaJaUoyiNe2dV http://www.Village-Buzz.com http://www.ThoseOptimizeGuys.com http://www.coffee-black.com http://www.painlessfrugality.com http://www.twitter.com/sergio_101 http://www.facebook.com/sergio101

2 1

Re: [Pharo-users] Validate password with PBKDF2
by Pierce Ng June 30, 2017

June 30, 2017

On Fri, Jun 30, 2017 at 12:43:23AM -0700, Francis via Pharo-users wrote: > Saving the salt is not a big issue but I'd like something more simple. > In python I can store the salt with the password > see:https://pypi.python.org/pypi/bcrypt/3.1.0 Hi, you could try PasswordCrypt: https://github.com/PierceNg/PasswordCrypt Pierce

1 0

Validate password with PBKDF2
by Francis June 30, 2017

June 30, 2017

Hi folks I'm playing with the PBKDF2 package of Udo: http://www.smalltalkhub.com/#!/~UdoSchneider/PBKDF2 (thanks Udo), but I can't find how to validate a stored hash. Can you point me in the right direction? Thanks Francis -- View this message in context: http://forum.world.st/Validate-password-with-PBKDF2-tp4952973.html Sent from the Pharo Smalltalk Users mailing list archive at Nabble.com.

2 2

Pharo6 playground saving semantics and .changes?
by Tim Mackinnon June 30, 2017

June 30, 2017

Hi - I really like the playground metaphor, it really is such a nice way to experiment. However I've noticed that unlike older versions of Smalltalk, it seems that DoIt operations in playground don't end up in the .changes file anymore (which I guess is a mixed blessing when you want to recover). It seems that the new metaphor is that work you do is saved as a page and you can see versions of your page in the upper right menu? Well sort of - as I haven't quite understood when it saves or doesn't? Often I get duplicate looking pages in that menu and often I make a change and want to keep it but find it doesn't save and if I accidentally close my playground my changes in a page are lost? What are the semantics of page saving? An example - if you do a few gofer loads of utilities and the put a comment on the first line of the page (which gives it a nice title in the page dropdown), sometimes that comment will be saved other times not? I also think it might be nice to remove page versions to help tidy things up. I'm thinking of rolling my sleeves up on this idea - but wanted to understand the vision firsts Tim Sent from my iPhone Sent from my iPhone

4 5

Solved: ZdcPluginMissing: SSL/TLS plugin initailization failed (VM plugin missing ? OS libraries missing ?)
by Offray Vladimir Luna CÃ¡rdenas June 29, 2017

June 29, 2017

Hi, Thanks Sven. This solves the problem. The issue was the 32 bit library. I don't know if this should be added as some kind of annotation or footnode to [1], because the chapter suposse a 32-bit Ubuntu Gnu/Linux deployment, but some of us are going to try similar stuff in similar environment, forgetting to install the 32 bits libraries. Anyway, if there is any room for this, I would be happy to make the edition with the respective pull request. [1] https://github.com/SquareBracketAssociates/EnterprisePharo/blob/master/WebA… Cheers, Offray Ps: Sorry to open a new thread. My mail was having some issues and didn't get updated threads.

1 0

June 29, 2017

Hi, I am writing tests with streams, and I noticed that a stream opened on a string doesn't close, but FileStreams do close. Is it normal ? -- JÃ©rÃ©mie Regnault

3 2