Visual Basic Question: Login/Password Authentication

Hello again! Im sure alot of you noticed my VB questions... you all have been AWSOME help.


Goal: Be able to have a user enter a log in name, and a password in a form, have the form search for the credintials on a database (access) (to see if they are correct) and then allow the user to go on to the next form.

Question: I have no idea how to do this, I dont know how or what syntax to use when the user presses "enter". Basically i got 2 text boxes Name/Password. I have a database using access. how do i link the 2 together? How do i even tell the form "if this matches what the database then go to next form, else msgbox blab bhab blahb" i hope thats enough info... Im still a new comer at this, this project due in less then 48 hours. a team mate dropped this on me so its urgent! thnx again.

Disclaimer: I am neither an expert in VB, nor do I enjoy programming in Microsoft environments:

My best guess from experience is:

- Open an ADO connection to the database (instantiate an ADODB.Connection object)
- Execute a SQL query to return the user's password (making sure you escape any funny characters in the username)
- Compare the password retrieved with the entered password
- For increased security, store the passwords with one-way encryption and compare the encrypted versions

There might be a much easier way but that's how I'd do it.

-- Separate security-related note

What constitutes "Funny characters" is database-dependent. Normally in SQL you would consider a single quote a funny character, but AFAIK, MSAccess has at least one more, the "pipe" character. Bear this in mind and deal with it accordingly.

For maximum safety, check that the username is alphanumeric and reject it otherwise.

**Moved from Antionline: How do I? to Programming Security**

Note: Antionline: How do I? is for post about how to do things on Antionline like delete threads, move threads, etc.

Quote:

---

Originally posted here by TSeNg

Question: I have no idea how to do this, I dont know how or what syntax to use when the user presses "enter".

---

In VB, when one double clicks on an object, the code widow cmes up, and for text boxes, it has the handling for the changing of text method open.

Select the KeyPressed() event and use that to say something along the lines of:

If (KeyAscii = 13) then '13 is the ascii code for carriage return
do database compare
end if

I'll look into the database later today, but I beleive you need to add a data object or 2, and then there is a property of which data source (your database) to link that to. From there, I'd check something more VB specific online.

i would also advise using a one way encryption method to verify the password.

Quote:

---

A cryptographic archive of 18 popular encryption algorithms, 6 popular hash algorithms and two popular compression and encoding algorithms for Visual Basic 5.0+. Changes for v2: Base 64 encoding instead of Hexadecimal encoding, fixed key initialization functions, updated the EBCrypt library, added CryptoAPI demonstrations from other authors, the inclusion of several classical ciphers, and an HTML page of crypto links. By David Midkiff

---

http://packetstorm.linuxsecurity.com...BCrypto_v2.zip
i use this library all the time, very useful ;)
taken from the packetstorm archives...

Shameless plug but: VB encryption is a small function that I have written to do one-way encryption in VB - it's very small (only about 10 lines of code) and not too difficult to understand.

I would avoid using anyone's 'home grown' solutions. Most look good at first, but the algorithms are usually flawed and open to attack. Go with a proven, tested solution.

There are a few providers of crypto api's out there that will do what you need. Microsoft has one available to you as well. Here is a book on how to use it, it also explains how crypto works - http://www.amazon.com/exec/obidos/tg...books&n=507846

As for ado, there are some decent books and tutorials out there on how to do it. You just need to learn the basics on how to use the connection, recordset, and command objects.

Slarty's steps from above are the path you want to take. Although in step two I wouldn't return the password, transmitting that back to the client is a bad idea. It would be simpler to compare the two hashes while still in the stored procedure or sql statement and pass back a code to indicate whether a match was found or not.

Quote:

---

Originally posted here by Juridian
[B]I would avoid using anyone's 'home grown' solutions. Most look good at first, but the algorithms are usually flawed and open to attack. Go with a proven, tested solution.

---

There is nothing inherently wrong with "home grown" solutions - and they are not necessarily any more insecure than ones written by Microsoft or anyone else.

I find that the ones that come with VB or can be purchased as add-ons tend to try and cover too many eventualities. My code simply takes a plaintext and produces a 32byte Hex hash from it. It has been tested not only by me (and is used in my current computing project), but also other people who have emailed me asking if they can use it in their code as well.

If you find any flaws in my algorithm, please let me know and I'll fix it. Until then, don't dismiss "home grown" solutions as being "usually flawed and open to attack".

What is inherently wrong with 'home grown' solutions is that they are done by amateurs, and usually not tested well enough to warrant use in a production environment.

I simply give the same advice that any larger information security entity (such as SANS/GIAC) would give.

Maybe you should not let posts on a message board affect your ego....

Quote:

---

Originally posted here by Juridian
What is inherently wrong with 'home grown' solutions is that they are done by amateurs, and usually not tested well enough to warrant use in a production environment.

---

Depends how you define 'amateur' really...

Quote:

---

Maybe you should not let posts on a message board affect your ego....

---

Maybe you shouldn't be so dismissive of other people's work and assume that everyone who writes a "home grown" solution is an amateur.

Quote:

---

Originally posted here by slarty
- Open an ADO connection to the database (instantiate an ADODB.Connection object)
- Execute a SQL query to return the user's password (making sure you escape any funny characters in the username)
- Compare the password retrieved with the entered password
- For increased security, store the passwords with one-way encryption and compare the encrypted versions

{snip}

For maximum safety, check that the username is alphanumeric and reject it otherwise.

---

Yes. Make damn sure the username/password is something YOU want or else you might open up some SQL injection hole.

woah woah, okay getting off of topic here guys..... :-) i got less then 24 hours left.

if you go to try2hack.nl you can find one of these on one of there levels to try to hack, but to make it in a database, there should be a database option in the controls (where u can edit the caption, font, name, etc....) and from there u can edit the database and how to update it and all.

this i know, i have done a program similiar to this in my VB class at school, i helped design the password program, but a decompiler and a knowledge of vb can easily hack the password/user program.

i just wrote a small example of a some-what secure login process...
care to take a look? http://www.antionline.com/showthread...hreadid=244000

I REALLY dont care if its secure, i just need the form to look at what the user typed in the text boxes, look at the database, and then say "hey i see it here, you can go on to the next form" thats it, no encryption or stuff, plain text.. hahaha
in my program you have to register, then your data will go to a access database,( i know how to do that) then you must use your email and password to go into the next form. i want the text boxes to look at the database and say "hey your info is here, you may go hit up the rest of the project" or else give them a nast message saying NO! you may not come in!!! 20 hours left.. payce

oh 99cent how am i going to link that to a database thats my main problem.

You keep putting down the time you have left....if you weren't screwing around on this message board you could have had the application done hours ago.

Are you hoping for someone to write your code for you or what?

/me thinks someone hasn't been paying attention in class and is now looking for someone to save his ass.....

man, for 1, i havent put this off. Im doing the project fine bro, I have payed attention the thing is we NEVER learned it. Im not expecting you to write it for me. im here because i need help finding the write syntax to access the database .... im in a rush because there are 4 team members, and all of a sudden i went from 1 part of the project to 3 parts. im only putting the time now because i dont have much of it, and replys are vidal, everyone has helped alot, but i just need an example to off by, i guess im being too pushy about sorry, thnx for everyones help.

http://msdn.microsoft.com

http://www.google.com

http://www.15seconds.com

http://www.planetsourcecode.com

i told you how to link the database's its easy, just go to the properties menu on your right, and scroll down to database, than make the database acess!!! set up access to do what u want and it'll be fine, dood its not that hard. I have done made one before, hacked it, than made it more secure, dood its easy!!!! ahhhh, oh ya, y don't u just get a decompiler, and go to someonelses proggy and look at what they did!! that could help you out to, but dood, its easy!!!! you could have figured it out on your own!

A de-compiler? Why go through that much trouble when there are millions of lines of source code available for free on the net already that would show examples of what he needs? A simple google search would have returned everything needed in less than a minute....

ya, correct, i am in vb class right now, and i showed my teacher this thread and he agrees with my awnser, its right

Delta4ce: You cannot decompile executable files and expect to be presented with the Visual Basic code, otherwise what's to stop everyone decompiling Windows and stealing stuff from it?

Sure, you can disassemble an executable, but that won't help you much if you want to learn VB.

thats not what i am talking about, i was talking about his database problem, i know u can't decompile exe's and get the vb u want !! i wasn't talkin about that.

Ok, this is un-secure and crappy coding but I just slapped some stuff together so you can figure out how it works, wouldn't want you to fail your class. :) By the way VB isnt my thing so theres probably I better way, but nothing came to mind. This logs some stuff in the DB about failed attempts etc.

Globals:

Public MyConnect As New ADODB.Connection 'For Queries
Public MyRecordset As New ADODB.Recordset 'For Queries
Public cmd As New ADODB.Command

Public Const ConnectString = "provider=Microsoft.Jet.OLEDB.4.0; data source=SomeAccessDB.mdb"
Public LogonTries As Integer


Some login form:

Private Sub Command3_Click(Index As Integer)
Dim Tries As Integer, EventNumber As Single
Dim User As String, Pin As Single
Pin = 0
If LogonTries < 3 Then
User = Text1
Pin = Val(Text2)
'*** Grab Event Number (If there isn't one set to 0)

cmd.CommandText = "SELECT EventNo FROM Loginout"
MyRecordset.Open cmd, , adOpenDynamic, adLockBatchOptimistic
If MyRecordset.EOF Or MyRecordset.BOF Then
EventNumber = 0
Else
MyRecordset.MoveLast
EventNumber = MyRecordset!EventNo + 1
End If
MyRecordset.Close
' ***
' *** Now See if Customer Exists with that PIN

cmd.CommandText = "SELECT * FROM Customers WHERE CustID = " & Chr(34) & User & Chr(34) & " AND CustPIN = " & Pin
MyRecordset.Open cmd, , adOpenDynamic, adLockBatchOptimistic
' *** Is there a record?
If MyRecordset.EOF Or MyRecordset.BOF Then
LogonTries = LogonTries + 1
Debug.Print "Invalid Login"
MyConnect.BeginTrans
MyConnect.Execute "INSERT INTO Loginout (EventNo,EventType,EventID,EventDate) values (" & EventNumber & "," & Chr(34) & "Invalid Log-in " & Chr(34) & "," & Pin & "," & Date & ")"
EventNumber = EventNumber + 1
' Increment Event
MyRecordset.UpdateBatch
MyConnect.CommitTrans
MyRecordset.Close
Text1.Text = ""
Text2.Text = ""
FailLogon.Show

Else
Debug.Print "ID accepted"
MyConnect.BeginTrans
MyConnect.Execute "INSERT INTO Loginout (EventNo,EventType,EventID,EventDate) values (" & EventNumber & "," & Chr(34) & "ID Accpeted " & Chr(34) & "," & Pin & "," & Date & ")"
EventNumber = EventNumber + 1
'Increment Event
MyRecordset.UpdateBatch
MyConnect.CommitTrans
MyRecordset.Close

' *** This means we've logged in succesfully

ActiveUserID = User 'Set Global Variable to keep track of User
Inquiry.Show

End If

'**** LoginTries has exceded 3

Else
cmd.CommandText = "SELECT EventNo FROM Loginout"
MyRecordset.Open cmd, , adOpenDynamic, adLockBatchOptimistic
If MyRecordset.EOF Or MyRecordset.BOF Then
EventNumber = 0
Else
MyRecordset.MoveLast
EventNumber = MyRecordset!EventNo + 1
End If
MyConnect.BeginTrans
MyConnect.Execute "INSERT INTO Loginout (EventNo,EventType,EventID,EventDate) values (" & EventNumber & "," & Chr(34) & "Log-in Attempts Exceded" & Chr(34) & "," & Pin & "," & Date & ")"
MyRecordset.UpdateBatch
MyConnect.CommitTrans
MyRecordset.Close
' *** Account Lock Out msg and Exit program
MsgBox ("Attempts Exceded")
Dim AForm As Form
For Each AForm In Forms
Unload AForm
Next
End


End If
End Sub


Private Sub Form_Load()

Set MyConnect = New Connection
With MyConnect
.ConnectionTimeout = 10
.Open ConnectString
End With

cmd.ActiveConnection = MyConnect
End Sub




If you cant figure it out from this, I cant help you. Hope this helps you out.
-Maestr0