I have a to write a program with Qt/C++ that is supposed to work with an awkward cryptographic platform based on CAPICOM/IE6 and a USB token holding the private key of digital signature. Users of system must follow these steps to login:
Install a fake root CA on their system
Install CAMICOM
Plug their token
Open Internet Explorer (and no, other browsers won't work), enter the URL, enter username and password, click on login.
I'm planning to remove CAPICOM (if possible) and make the system as cross-platform as possible. I can think of two scenarios:
Remove CAPICOM and make a replacement for it using modern cross-platform tools
Somehow make the Qt code to use CAPICOM and remove web browser's role.
Any help about how CAPICOM works (especially what exactly it is signing) and how to connect to USB token (ePass 3003) is helpful.
Related
I have the problem that I want to program a program that will have to interact with some 3rd party web service. This service requires for specific actions that the client (my program) authorizes itself by both a username/password combination as well as a token. The username/password is specific to the user of my program and no of a problem here. The token (API key) is a problem.
Suppose I want to make my program open source and put its sources on some public server. Of course I cannot hardcode (or include) the API key. Otherwise I would not only break the contract not to publish it but also any (non-authorized) usage will fall back onto me and my program.
According to my research (e.g. Open source a project but keep API keys confidential or How to hide the API key in my Electron application?) I could put a proxy server (closed source) between the 3rd party API and my program. Now I see two big open doors for bad-minded people to attack this scenario:
As the source code of the main program is open source, any interaction with the proxy can be literally read from source code. An attacker could fork my main program and use exactly the same calls on the proxy but with compromised data. Same result as with openly available keys: My program will get into trouble for other people's bad actions/programming skills.
I could add a username/password to authenticate the program against my proxy. I then offer (free-to-use) registration to the proxy in order to allow my program to be used productively. This adds an additional layer of authentication and complexity but is doable. Anyone really wanting to do bad things will nevertheless be able to obtain a password and use his own fork to access the proxy. I cannot put my own keys/encryption/.... anywhere as the necessary routine to decrypt/imitate these will be publicly visible in the open sourced project.
So now I have simply shifted the problem to detect if the running software is an original one, from the 3rd party to my proxy server. I only have the benefit that I could maybe know which user was the bad guy and ban him but this is all I can do while my token might get revoked by this issue.
I am sorry but I did not find a usable solution in the web to this specific problem. How can I attack this problem (on an abstract level)?
I'm thinking of use VMWare API Vix to manage VmWare operations. I've been checking documentation but all the scripts uses variables with the password in plain text.
I'm not feeling sure with this and I want to hash or protect this password without having then in plain text
Any ideas?
Since vmrun is command-line utility for VIX API, it requires plain text password. And your password will be visible on Console Application.
If you can use VixCOM you can protect the passwords before calling the operation. I have used this library in C# https://github.com/dblock/vmwaretasks and used 3DES to protect my passwords before calling individual operation.
One should try to avoid passing clear password and only decrypt it close to operation which requires it.
Just following up on this question a little. 02Anant pretty much has the guts of your question addressed.
Since the VMWare API is available in powershell, C#, Java and Python your exact implementation is going to be specific to the API language platform you use. I'm mostly familiar with writing VCS integration using vRA forms for input, vCO workflows and Java plugin code for the encryption, storage and heavy lifting.
If you are insistant on using the CLI then the VAPI samples are written to be used that way and can provide a great resource. If you want to take in a password then envoke a script that prompts for the password (or username and password) without echoing and then perfoms your actions so you can mask what password is typed from peering eyes.
You will be correct in masking the password in any UI you provide, encrypt the password if putting into storage and only decrypt the password at the point you send credentials across the wire. The API provides SSO connection to vCenter and therefore after authentication you will be using a token for the procedure calls.
This is on Mac 10.8
I have written Google Chrome Extension and a Native Messaging executable which communicates with the Chrome Extension using Native Messaging. All works fine with my Proof of Concept as part of development.
Issue is that now I want to get it deployed.
I have my in house installer which by which I need to create a com.my_company.my_product.json manifest file inside of this /Library/Google/Chrome/NativeMessagingHosts directory which cannot be accessed unless I ask for the password of the admin user.
I am doing this port as part of migration of NPPlugin to Chrome Extension Native messaging communication which will replace the NPPlugin. NPPlugin can be accessed from both /Library as well as ~/Library which does not require sudo permissions.
Why does the manifest file need to be at root /Library level ad not user ~/library level? If so how can we get this installed on a Mac without bothering the user with admin password which the user will obviously be less likely to share.
If anyone has a solution, the Native Executable is a C++ program that can use Mac API calls.
Your understanding is correct. The Chromium team is investigating user directories as an additional option. Ensuring continuing security is the primary concern. I'll update this answer when there's more to report. (Update 6/1/2014: see Rob W.'s comment to this answer)
I am building a windows 8 application which will be used as the interface to a web service I have running.
I need to find a safe way of encrypting sensitive data to pass, then decrypt it the other end.
Two things I need to do (as they may require separate methods);
1) User will enter a username and password which needs to be authenticated
2) User will enter personal information to be saved.
Now I have looked at many encryption/decryption methods, but I cannot find anything which is common place between the two. For example System.Security.Cryptography is not available within the windows 8 app, and my website can't use CryptographicEngine.
I am basically trying to find the best way to DO what I need to do. Along with a way of actually doing it in code.
You will not be able to use the same namespaces, as you have recognized. What you need to do is settle on a standard crypto algorithm on both ends.
Here is a discussion for one approach on the Win8 side using AES256. http://social.msdn.microsoft.com/Forums/en/winappswithcsharp/thread/8f9ecac4-80d2-47c8-8c41-9d7877565bf5
Here is a solution for doing AES256 with regular .NET
http://msdn.microsoft.com/en-us/magazine/cc164055.aspx
If you just need to secure the channel, then use an HTTPS web service, that's what HTTPS was designed for. The client-side HttpWebRequest class should just do the rest for you.
You'll need a certificate on the web server.
I'm using WinHTTP to write an an app that needs access to the internet, and is potentially behind a proxy. Everything works (almost) out of the box is the user is on a domain, but if he or she isn't then I need a way to ask for credentials. Is there a standard way of doing that, or should I write my own dialog?
Ideally I'd like something that mimics IE's username/password dialog.
Thanks.
CredUIPromptForCredentials() (or one of its variants) is probably what you're looking for. This provides a consistent look and feel with the version of Windows your software is running on.