Very interesting issue with Okta here, especially with the use of bcrypt
https://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username/
As Yan (@bcrypt) said
“reminder that the bcrypt hash function ignores input above a certain length! so if you do bcrypt(username || password) for some reason, a sufficiently long username will make it accept any password. to fix this you can sha256 the input first”
Daniel Cuthbert
npub1mx…9pnmm
2024-11-02 07:13:49 UTC
Author Public Key
npub1mxglgd9hl0636h90jlslme5yl66ez0hgzgx3tz5387qd4p3vuhfqd9pnmmSeen on
wss://relay.momostr.pinkPublished at
2024-11-02 07:13:49 UTCEvent JSON
{
"id": "7636ccf738f8f98995b02029361c2bcea5b35f7b10de01231894b262d0aef757",
"pubkey": "d991f434b7fbf51d5caf97e1fde684feb5913ee8120d158a913f80da862ce5d2",
"created_at": 1730531629,
"kind": 1,
"tags": [
[
"proxy",
"https://defcon.social/@dcuthbert/113412120883744611",
"web"
],
[
"proxy",
"https://defcon.social/users/dcuthbert/statuses/113412120883744611",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://defcon.social/users/dcuthbert/statuses/113412120883744611",
"pink.momostr"
],
[
"-"
]
],
"content": "Very interesting issue with Okta here, especially with the use of bcrypt\n\nhttps://trust.okta.com/security-advisories/okta-ad-ldap-delegated-authentication-username/\n\nAs Yan (@bcrypt) said \n\n“reminder that the bcrypt hash function ignores input above a certain length! so if you do bcrypt(username || password) for some reason, a sufficiently long username will make it accept any password. to fix this you can sha256 the input first”",
"sig": "bd3026f5f5d7491e40813d2675ca10639c17700d67067e237b0e3004aa3fc97725470587d8d049d8b4348d05a68ab814dee46857a6db744d59152616787d4bdc"
}