Message Boards

unable to encrypt login id and password from liferay login over the network

thumbnail
vipin kumar, modified 10 Years ago.

unable to encrypt login id and password from liferay login over the network

New Member Posts: 15 Join Date: 6/5/12 Recent Posts
Hi,

login id and password of user is travels as plain text over the network ,

is there any way by which user credentials will go as encrypted over network ?

any help would be appreciated ..
thumbnail
sushil patidar, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Expert Posts: 467 Join Date: 10/31/11 Recent Posts
vipin kumar:
Hi,

login id and password of user is travels as plain text over the network ,

is there any way by which user credentials will go as encrypted over network ?

any help would be appreciated ..



Hi,
Can you please check whether user login password is encrypted in the DB table ?

Regards
thumbnail
vipin kumar, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 15 Join Date: 6/5/12 Recent Posts
Thanks for the response ,

but my question is when user sign-in with their credentials from sign in portlet then their credentials are going as
plain text over the network (i am not asking about login id & password encryption in the DB table, they are already encrypted and everything works fine at DB level)

see the screen shot attached herewith for further clarification..(i want this login id and password should be travel over the network as encrypted)

Attachments:

thumbnail
Christoph Rabel, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Liferay Legend Posts: 1555 Join Date: 9/24/09 Recent Posts
Well, it depends on the schema you use:
http:// plain text
https:// ssl encrypted

So, you need to configure your server to allow https connections. Depends on your server how you do that, e.g for tomcat:
http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
thumbnail
vipin kumar, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 15 Join Date: 6/5/12 Recent Posts
thats true that ssl is one of the option to achieve this..

but i want to make it via custom encryption means
step1: to encrypt credentials on submit of login form from login portlet
step2: then credentials will travel as encrypted over the network
step3: override some class(dont know exactly may be LoginAction.java) to decrypt the credentials

can any body tell me how can i achieve step 3 , i have the decryption algo but unable to implement that logic over liferay source file
which source file should i use to implement my logic ?
and how to customize that file ?
thumbnail
Milen Dyankov, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Expert Posts: 310 Join Date: 10/30/12 Recent Posts
Why would you want to do that?

The steps you describe are implying that
- the algorithm you use is bidirectional (one can both encrypt and decrypt)
- you are using JavaScript (or some other scripting language) on the client side for encryption

which means that "man in the middle" could easily look at your JavaScript logic and figure out how to decrypt the values.

Personally I believe a FALSE sense of security is worse then no security and this seems to be exactly what you are after!
thumbnail
vipin kumar, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 15 Join Date: 6/5/12 Recent Posts
Hi Milen,

I would like to do that encryption -decryption thing for one of our project on liferay cms, we have done security audit for that & found Sensitive Data Exposure vulnerability in that so inorder to over come that we like to try this encryption -decryption method..

is there any other settings or way other than SSL implementation to resolve that issue
thumbnail
Milen Dyankov, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Expert Posts: 310 Join Date: 10/30/12 Recent Posts
If your site is accessed by users you are not controlling (outside of company environment where you can enforce policies and browser customization) then I would say NO. There are some initiatives in place but nothing that all major browsers support right now.

And here is why you SHOULD use SSL: https://www.owasp.org/index.php/Top_10_2010-A9-Insufficient_Transport_Layer_Protection
thumbnail
vipin kumar, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 15 Join Date: 6/5/12 Recent Posts
Milen,

I have tried to customize LoginAction.java of liferay through hooks but getting error of class-def-not found and class-not-found errors
so, can you guide me about how can i customize LoginAction.java file of liferay
thumbnail
Milen Dyankov, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Expert Posts: 310 Join Date: 10/30/12 Recent Posts
You can not do that with hook. If you want to customize Java class you need EXT plugin. You can however add custom Actions to the pipeline via hook.

I don't know what you are trying to do so I can;t tell which approach should work better for you.
thumbnail
Vipin Kumar, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 15 Join Date: 6/5/12 Recent Posts
ok thanks milen,

Just tell me one thing which java class is used by liferay login portlet for getting login id and password from login.jsp page of login portlet

is it com.liferay.portlet.login.action.LoginAction or
com.liferay.portal.action.LoginAction or something else is there

so i can try EXT plugin customization over that...
thumbnail
Milen Dyankov, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Expert Posts: 310 Join Date: 10/30/12 Recent Posts
The portlet uses "com.liferay.portlet.login.action.LoginAction" but keep in mind the portlet is not the only login entry point.
And let me repeat again, if you try to use this to implement point 3 in your original post - you are most likely doing the wrong thing!
Anyone who can intercept your traffic and capture unencripted login and password will still be able to capture the encrypted ones and
1) use them to log in
2) easily decrypt them (by applying your own logic)

If you are doing this to fool someone (or some security checking tool) then well I hope you have good reasons. But it doesn't change the fact that it DOES NOT make your site much secure than using the OOTB login plugin.
thumbnail
Vipin Kumar, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 15 Join Date: 6/5/12 Recent Posts
thanks for your information sharing

I will keep your point in my mind
Thanks
thumbnail
sushil patidar, modified 10 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Expert Posts: 467 Join Date: 10/31/11 Recent Posts
Hi,
I agree with Milen that he justified in the above post. Rather than encrypting data using JS you should use HTTPS protocol. For more information how to configure SSL you can find in detail on link.

Regards
gvs cbe, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 6 Join Date: 5/26/19 Recent Posts
Hi,
Liferay community edition : 7.0
Is there any solution with http instead of https  for Sensitive Data Exposure vulnerability - password as encrypted over network instead of plain text ?
Or If SSL is implemented hashed data will be achieved with company.security.auth.requires.https=true?
Thanks
thumbnail
Olaf Kock, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Liferay Legend Posts: 6403 Join Date: 9/23/08 Recent Posts
gvs cbe:

Is there any solution with http instead of https  for Sensitive Data Exposure vulnerability - password as encrypted over network instead of plain text ?
Or If SSL is implemented hashed data will be achieved with company.security.auth.requires.https=true?
It's 2019. Use https, no matter if you have sensitive data to expose or not. Use HSTS on top of it. Eliminate http or only have it redirect to https, without delivering any content.
I'm not sure what you mean with your property related question, and it's irrelevant if you fully use https. "Mixed mode", e.g. using https to log in and http otherwise is dead for a couple of years now, latest since Firesheep came along in 2010.
thumbnail
Milen Dyankov, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Expert Posts: 310 Join Date: 10/30/12 Recent Posts
The property
company.security.auth.requires.https=true
only tells that authentication is required to happen over an HTTPS connection. That's it. 

There is NO standard way to encrypt sensitive data while accessing web resources with a browser other than HTTPS! At least not to my knowledge. In some cases a VPN can be considered alternative solution but that is not something you can do for random access. 
Bottom line is, if you want some date to travel encrypted between your browser and the server you are accessing - ALWAYS USE HTTPS ! And as Olaf said - the best approach is to do it for all communication and keep HTTP to only redirect to HTTPS. The reason is, the password is NOT the only sensitive piece of information.  There are tons of ways to attack, highjack,  fake, ... an HTTP session/request and get access to users' accounts without knowing the password.  
gvs cbe, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 6 Join Date: 5/26/19 Recent Posts
Hi,
Thanks for the reply,
I confgured https in localhost and tested the form data in params it again displays the password as plain text as below,
Form data    
_com_liferay_login_web_portlet_LoginPortlet_password    test
Please advice to solve this vulnerability.
Thanks
thumbnail
Arun Das, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Regular Member Posts: 166 Join Date: 7/23/12 Recent Posts
This is not a vulnerability. The data you see is on the client side (browser) form data, once you send it over SSL it will be in encrypted form, so when someone try to sniff the packet, they won't see any sensitive data. You can use WireShark to analyze the packet and verify.
gvs cbe, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 6 Join Date: 5/26/19 Recent Posts
Yes, i send it over SSL still it shows the plain text in network params
Can we use PwdGenerator or PasswordEncryptorUtil to pass the salted hash value as a password over the client browser,
Please guide as it is marked as vulnerability by IT security team.
thumbnail
Olaf Kock, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Liferay Legend Posts: 6403 Join Date: 9/23/08 Recent Posts
gvs cbe:

Please guide as it is marked as vulnerability by IT security team.
There is nothing to fix here.
You may want to ask your IT security team to try the same strategy on any other system out there, where you transmit username/password. You'll be able to see the same behavior everywhere. As soon as the data is protected through https, you're fine.
If you hash the password on client side, the new hashed password effectively becomes your password. Worse: If this implies that there's no more hashing done on server side, now the server would implicitly store a clear-text password. E.g. hashing client side doesn't fix anything, but has the potential to make it much worse.
There's really nothing to see here.  Your browser will have access to your username and password - naturally. But nobody on the wire will have it, provided that you correctly are using https.

The title of this thread is "unable to encrypt login id and password from liferay login over the net(work)", and there's nothing wrong with the network (provided you use https). All you can demonstrate is that the data is available to the browser (before it enters the network). And if the browser can't have access to the data, how would you want to sign in at all?
thumbnail
Milen Dyankov, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Expert Posts: 310 Join Date: 10/30/12 Recent Posts
gvs cbe:

Please guide as it is marked as vulnerability by IT security team.
I have this feeling there is some serious misunderstanding going on here. You don't provide enough information which forces people to make assumptions about what you mean. To avoid that please explain your case in details. What exactly is "marked as vulnerability"? Whaht exactly have you configured? How do you check what is transmitted over the network? Why do you believe "salted hash value as a password" would solve the issue?  
gvs cbe, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

New Member Posts: 6 Join Date: 5/26/19 Recent Posts
Vulnerability : Sensitive Data Exposure
What exactly have you configured? :  SSL
How do you check what is transmitted over the network? Web Developer - Inspector Tool and also in Burp Suite

While Capturing Params of banking site Password is not sent as Plain Text for ex it passes as below
password   : 5fc5cef1eb3234d1bda69582b94398e6c557bf01d2bc9fe4394a8925469b4a06426fe4eb27387de6e8dd686d594a59db16c311aa3cbb325bdad116c3a8acaee7
Liferay uses in-built algorithm "PBKDF2WithHmacSHA1/160/128000" for storing Hash value in database, Instead of showing password as a plain text in client browser can we show the hashed value as like banking site?
Sorry for misunderstandings.
thumbnail
Olaf Kock, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Liferay Legend Posts: 6403 Join Date: 9/23/08 Recent Posts
gvs cbe:

Vulnerability : Sensitive Data Exposure
What exactly have you configured? :  SSL
How do you check what is transmitted over the network? Web Developer - Inspector Tool and also in Burp Suite

While Capturing Params of banking site Password is not sent as Plain Text for ex it passes as below
password   : 5fc5cef1eb3234d1bda69582b94398e6c557bf01d2bc9fe4394a8925469b4a06426fe4eb27387de6e8dd686d594a59db16c311aa3cbb325bdad116c3a8acaee7
Liferay uses in-built algorithm "PBKDF2WithHmacSHA1/160/128000" for storing Hash value in database, Instead of showing password as a plain text in client browser can we show the hashed value as like banking site?
Sorry for misunderstandings.

I hate to break the news to your IT security team: The developer tools capture of the submitted request also shows the JSESSIONID cookie value. Anybody who knows this value will be able to impersonate you once you are logged in, even without knowing the password at all. That's precisely what https (and TLS) will protect you from. I guess they didn't alert you for transmitting the session id cookie. Rightly so, because just like the password it will be protected in transit by TLS.
And, again: If you hash the password client side (using PBKDF...) you are essentially replacing your chosen cleartext password with the hashed password.
Your IT security team is wrong pointing this out as a vulnerability. Everybody who uses username/password as authentication simply uses TLS as protection. If your browser is compromised, TLS won't help you. And no Javascript mumbojumbo will help you either.
Anyway. I'm out - this is my last comment on the thread.
thumbnail
Milen Dyankov, modified 4 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Expert Posts: 310 Join Date: 10/30/12 Recent Posts
OK. Few things to note here.
  1. The reason why you see the password with  Web Developer - Inspector Tool is because it runs in the very same browser that was used to send the form. The browser and thus the tool knows what was send and helpfully shows that to you. However if your SSL is properly configured, all this information is encrypted before it leaves your browser. Thus no one else can see it while it's being transmitted. This is pretty standard behaviour. Major websites like Facebook and Google work the same way (see screenshots below).
  2. It is true that inside the data package that is encrypted by the the browser, the password is in plain text. The assumption here is that for someone to be able to see is (while it's being transferred) one has to brake the SSL encryption between the browser and the server. However if that is the case, you have an order of magnitude more serious problem  that the password being not hashed.
  3. The bank example you've shown indeed uses some kind of hashing for the password field. It is not clear what is the reason for that (it may or may not be related to extra security cautions) nor how exactly it is achieved in this particular case. In general case, for the reasons explained above, it does not provide any extra security.
  4. Liferay Portal does not provide anything that will hash passwords on the client side (in the browser). If your IT security team insists on doing that for your solution, you will have to do it yourself. You will have to implement this on both client side and server side. How exactly you do that is up to you. 


thumbnail
Mohammed Yasin, modified 3 Years ago.

RE: unable to encrypt login id and password from liferay login over the net

Liferay Master Posts: 591 Join Date: 8/8/14 Recent Posts