— Doug wrote

Question #1: If the mod takes the input password, and converts it to SHA1 as well as uppercasing, then passes it to a third party website ( strtoupper(sha1($password)) ) . How accurate do you think those result matches are going to be considering that most websites do not even use similar crypt processes? Example:

d802f03b1278597a441a71b8a3fc0b32bb08cd46 AND D802F03B1278597A441A71b8A3fC0B32BB08CD46 are not identical inputs, yet producing the first one, and submitting it as the second method is not going to produce an accurate check.

For this check to even be close to accurate, you would have to take the input string, hash it with the top 10 most common methods INCLUDING the md5(md5(md5(md5(md5( method, and submit them as checks each to themselves.[/align]

— Doug wrote

Question #2: Digging around the domain being submitted, there does not appear to be much information about what hash the passwords are being compared to, or if ( or can it be ) compared to a multitude of other hashes. Meaning: If the mod submits the sha1( string, but can not be compared to md5(md5(md5(md5(md5( (THIS is the method Evo uses) string, what would be the point of the check?

— Doug wrote

Question #3: Probably the most dangerous aspect, but why submit any password, let alone an unsalted password be broadcasted to a third party website? Would any of you submit your databases of passwords to be tested? If not, why are you publishing each log attempt to a third party website that you are unfamiliar with?

— Doug wrote

Question #4: Is it my memory that has faded so badly, but I could have sworn that Evo used a salting method at some point in history. Why is a salting method still not being used?

— coRpSE wrote

This is one of the biggest misconceptions. We never send the actual password, nor even the full SHA1 hash.

Here’s what happens:

• User types in their password.
  
• It’s hashed with SHA1 locally.
  
• We uppercase the result.
  
• We take only the first 5 characters of that SHA1 hash.
  
• That 5-character prefix is sent to

  Please login to see this link Get registered or Log in

  
  

HIBP then returns a list of matching suffixes (the remaining 35 characters) along with breach counts. This method is known as k-anonymity, it ensures HIBP never knows the original password or its full hash.

You can read about the privacy model here:

Please login to see this link Get registered or Log in

So the user’s actual password, or its full hash, is never exposed. Nothing identifiable is ever logged or transmitted.

— coRpSE wrote

Xtreme previously used an MD5-based hashing system, but that is no longer the case. As of last year, Xtreme has moved to using PHP’s password_hash() function, which includes strong salting and modern hashing (e.g., bcrypt) by default. Whis was done in responce to a security issue that I found that could be exploited by bad actors.

PwnGuard doesn’t interfere with or replace that system, it works alongside it by checking whether the user’s chosen password is already known to have been leaked in previous breaches. If it has, the user is warned or prevented from using it, even before it’s hashed and stored securely using password_hash().

$dbpass     = $setinfo['user_password'];
        $non_crypt_pass = $user_password;
        $old_crypt_pass = crypt($user_password,substr($dbpass,0,2));
/*****[BEGIN]******************************************
 [ Base:     Evolution Functions               v1.5.0 ]
 ******************************************************/
            $new_pass = EvoCrypt($user_password);
/*****[END]********************************************
 [ Base:     Evolution Functions               v1.5.0 ]
 ******************************************************/
        $new_pass = md5($user_password);
        $evo_crypt = EvoCrypt($user_password);
        //Reset to md5x1
        if (($dbpass == $evo_crypt) || (($dbpass == $non_crypt_pass) || ($dbpass == $old_crypt_pass))) {
            $db->sql_query("UPDATE ".$user_prefix."_users SET user_password='$new_pass' WHERE username='$username'");
            $result = $db->sql_query("SELECT user_password FROM ".$user_prefix."_users WHERE username='$username'");
            list($dbpass) = $db->sql_fetchrow($result);
        }
        if ($dbpass != $new_pass) {
            //Does it need another md5?
            if (md5($dbpass) == $new_pass) {
                $db->sql_query("UPDATE ".$user_prefix."_users SET user_password='$new_pass' WHERE username='$username'");
                $result = $db->sql_query("SELECT user_password FROM ".$user_prefix."_users WHERE username='$username'");
                list($dbpass) = $db->sql_fetchrow($result);
                if ($dbpass != $new_pass) {
                    redirect("modules.php?name=$module_name&stop=1");
                    return;
                }
            } else {
                redirect("modules.php?name=$module_name&stop=1");
                return;
            }
        } 

// EvoCrypt function by JeFFb68CAM
function EvoCrypt($pass) {
    return md5(md5(md5(md5(md5($pass)))));
} 

— coRpSE wrote

So, to answer your original question which is the topic title, "Is PwnGuard Mod not contributing to the existing problem?", my response is, Absolutely not. Not doing anything is to me contributing more than anything to the existing problem, which is growing. The people that stand to the side, bitch and complain, take no real action on their part, offer no good feedback, and overall stand on the sidelines stomping their feet like children when people don't bend to their every need is what is contributing to the existing problem.

— coRpSE wrote

(Sorry, most of that annoyance is from some of the old Raven community people that got under my skin many years ago about the HP and how it was too intrusive, among other things without even the basic understanding of it.)

I went back and dug through the code and noticed the $prefex of first 5 characters... I assumed the first method would call for the 2nd precision match, but I don't see that in the curl call. Damn sure nothing pushed to third party, however it not goes back to accuracy? How does this come close to any type accuracy?

— coRpSE wrote

Do me a favor, open your mainfile.php and find on line 59, what is NUKE_EVO defined as?

// Define File
define_once('NUKE_EVO', '2.0.9f');
define_once('EVO_EDITION', 'xtreme');
define('PHPVERS', @phpversion());
define_once('EVO_VERSION', NUKE_EVO . ' ' . EVO_EDITION);
define('PHP_5', version_compare(PHPVERS, '5.0.0', '>=')); 

— Doug wrote

— coRpSE wrote

Do me a favor, open your mainfile.php and find on line 59, what is NUKE_EVO defined as?

lines 57 through 62

PHP:  [ Select all ]

// Define File
define_once('NUKE_EVO', '2.0.9f');
define_once('EVO_EDITION', 'xtreme');
define('PHPVERS', @phpversion());
define_once('EVO_VERSION', NUKE_EVO . ' ' . EVO_EDITION);
define('PHP_5', version_compare(PHPVERS, '5.0.0', '>='));