Spaces

[m i l e s-2]

Hi

I'm wondering if anyone has ever seen this problem.

If I've taken a form value and saved that out to a file.  And then  
used that file as a supplied password file.  Shouldn't that file  
retain whatever characters were passed into it?

Miles


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Israel Thompson]

I think it depends heavily on which characters are being used,
encoding type of the document that's saving the file, the saved file
itself, and the file that's processing the saved file.

Sometimes spaces are really illegal characters in disguise!

Israel


> Hi
>
> I'm wondering if anyone has ever seen this problem.
>
> If I've taken a form value and saved that out to a file.  And then used that
> file as a supplied password file.  Shouldn't that file retain whatever
> characters were passed into it?
>
> Miles

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[m i l e s-2]

Israel,

I was thinking the same thing.

So should I be encoding the file BEFORE the document is saved ?

And encode it how ?  UTF-8 ?

Miles.

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[bilcorry]

m i l e s wrote on 7/9/2009 1:13 PM:
> I was thinking the same thing.
>
> So should I be encoding the file BEFORE the document is saved ?
>
> And encode it how ?  UTF-8 ?

Based on the information you've provided so far, the answer is "42"


- Bil


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Israel Thompson]

LoL, 42!

I would say try UTF-8 for all your docs, Miles.

Israel

>> I was thinking the same thing.
>>
>> So should I be encoding the file BEFORE the document is saved ?
>>
>> And encode it how ?  UTF-8 ?
>
> Based on the information you've provided so far, the answer is "42"
>
>
> - Bil

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[m i l e s-2]

Israel,

UTF-8 tried.  Failed.

By default, if memory serves, Lasso saves all docs as UTF-8 unless  
otherwise specified.

Any other suggestions ?

Miles.

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Israel Thompson]

Other than string->trim, I'm not sure...

That only works for spaces at the beginning and end though.

You're not doing any other type of Regular Expressions that may be
causing spaces to be inserted are you?

One our guys ran into something like this last week when he was
parsing XML and the problem ended up being the wrong order of regular
expressions and the string->trim tag. Not sure if that helps at all.

Straight form field into document? Have you pinpointed the spaces to
certain characters? Perhaps limit the password field to only
alphanumeric, underscores, etc?

Israel

> Israel,
>
> UTF-8 tried.  Failed.
>
> By default, if memory serves, Lasso saves all docs as UTF-8 unless otherwise
> specified.
>
> Any other suggestions ?
>
> Miles.

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Viaduct Productions]

Did he check what he's exporting beforehand to see what's in it?

More details would really help.



On 9-Jul-09, at 6:26 PM, Israel Thompson wrote:

> Other than string->trim, I'm not sure...
>
> That only works for spaces at the beginning and end though.
>
> You're not doing any other type of Regular Expressions that may be
> causing spaces to be inserted are you?
>
> One our guys ran into something like this last week when he was
> parsing XML and the problem ended up being the wrong order of regular
> expressions and the string->trim tag. Not sure if that helps at all.
>
> Straight form field into document? Have you pinpointed the spaces to
> certain characters? Perhaps limit the password field to only
> alphanumeric, underscores, etc?

Rich in Toronto
...now go get on your bike


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Israel Thompson]

Oh, I don't know... I know as much as you.

Israel


> Did he check what he's exporting beforehand to see what's in it?
>
> More details would really help.

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[m i l e s-2]

Israel,

 >Other than string->trim, I'm not sure...

Yeah can't do that in this case.

 >You're not doing any other type of Regular Expressions that may be
 >causing spaces to be inserted are you?

Nope.

 >Straight form field into document?

Yes.

 >Have you pinpointed the spaces to certain characters?

No.  And unfortunately they have I have to be able to process the  
field entry no matter what.

 >Perhaps limit the password field to only alphanumeric, underscores,  
etc?

Nope.  Can't limit the field entry for a variety of reasons.  This is  
a requirement that I must be able to allow all character types.

This is a users password.

Spaces and ODD characters are being forced on the user in an effort to  
stop blunt force dictionary attacks against the user/pass database  
with my client.

Miles.



--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[m i l e s-2]

Hi,

 >Did he check what he's exporting beforehand to see what's in it?

Yes.

Miles.

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[bilcorry]

m i l e s wrote on 7/9/2009 9:45 PM:
> This is a users password.
>
> Spaces and ODD characters are being forced on the user in an effort to
> stop blunt force dictionary attacks against the user/pass database with
> my client.

If someone can run a dictionary attack against the database, the first thing to do is restrict the number of failed tries and/or only allow connections from known IP addresses.

The problem with very strong passwords is they tend to be difficult to remember, so you end up with users writing them down and/or reusing them extensively.  If this is a highly sensitive application, then you should look at two-factor authentication.  That way, even if an attacker has the password, they still can't log in.  One example is PhoneFactor:

        http://www.phonefactor.com/


- Bil


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Viaduct Productions]

m i l e s:

You are not helping.

Please provide more data...we are so dry of information.

Stop dancing around the issue.  Otherwise answer remains at 42.


On 9-Jul-09, at 10:48 PM, m i l e s wrote:

>
> Hi,
>
> >Did he check what he's exporting beforehand to see what's in it?
>
> Yes.
>
> Miles.



Rich in Toronto
...now go get on your bike


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Viaduct Productions]

Sorry, I should have included:

M I L E S:   YOU ARE NOT BEING HELPFUL.





On 9-Jul-09, at 10:48 PM, m i l e s wrote:

> Hi,
>
> >Did he check what he's exporting beforehand to see what's in it?
>
> Yes.



Rich in Toronto
...now go get on your bike


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Jonathan Vanherpe (T & T NV)]

Viaduct Productions wrote:
> Stop dancing around the issue.[...]

I see what you did there...

--
Jonathan Vanherpe - Tallieu & Tallieu NV - jonathan@...

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Viaduct Productions]

On 10-Jul-09, at 5:05 AM, Jonathan Vanherpe (T & T NV) wrote:

> Viaduct Productions wrote:
>> Stop dancing around the issue.[...]
>
> I see what you did there...


It's one of my favourite moves.  All the kids are doing it.


Rich in Toronto
...now go get on your bike


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/