Archives for 2015

The challenge involve partially implementing some of our XMPP test client event handlers for namely join, receive and send. The result will be a client that people can use to join and chat securely. Note that the purpose of the challenge is for the EQ team to get to know the candidates and be comfortable with their C++ competence before commencing our interview process. Please reach out if you get stuck somewhere – this is not considered against you.

Step 1: Get the code and get it compiled:

You need our fork of libgrypt for it:

https://github.com/equalitie/libgcrypt

Then you need to get the code

https://github.com/equalitie/np1sec

and follow the README. Finally test with the mock client:

./libnp1sec_test

If you link to original libgcrypt you’ll get some kind of grypt related
error.

Step 2: Run the xmpp test client. It is implemented in

https://github.com/equalitie/np1sec/blob/master/test/xmpp_test.cpp

Login to two different accounts. try
to chat, etc.
Step 3: Implement the join/send and receive handler

Look at the example at:
https://github.com/equalitie/np1sec/blob/master/test/chat_mocker_np1sec_plugin.cc#L54

and

https://github.com/equalitie/np1sec/blob/master/test/chat_mocker_np1sec_plugin.cc#L127

Notes that in case of mock client join and receive handler both are being handled by chat_mocker_np1sec_plugin_receive_handler but it happens in different function in case of libpurple.

Step 4: Implement the call backs:

You need to give some call backs to np1sec library. You can find the
association in case of chat mocker here:

https://github.com/equalitie/np1sec/blob/master/test/session_test.cc#L62

mockops->send_bare = send_bare;
mockops->join = new_session_announce;
mockops->leave = new_session_announce;
mockops->display_message = display_message;
mockops->set_timer = set_timer;
mockops->axe_timer = axe_timer;
They are implemented here:

https://github.com/equalitie/np1sec/blob/master/test/chat_mocker_np1sec_plugin.cc#L135

You only need to implement send_bare and send a do nothing functions for set_timer/axe_timer.

Step 5: Test your client:

Follow the lines in

https://github.com/equalitie/np1sec/blob/master/test/session_test.cc#L189

to initiate the np1sec UserState and see if you can join and talk to yourself.

We are very pleased to announce that all websites signing up for DDoS protection with Deflect will now receive an authenticated password giving them easy access to their admin panel without having to reconfigure settings on their host server.

In the past, our practice has always been to set up a special secret login address which we would send to each site (known as a nocache address) and webmasters would then have to configure their servers to respond accordingly whenever they needed to access their admin page (as detailed in Step 5 of the Walkthrough on our wiki)

We did this to avoid any problems with the admin panel itself being cached. In such circumstances, any changes in content made to the website would be subject to the caching process rather than take effect immediately, thus affecting the user experience.

The problem has been solved by tweaking our detection software to distinguish between legitimate users and attackers – just as it does with traffic to the public website – by checking that the authenticated password and authenticated cookie match up whenever a request is made to log in. If everything does match up, the user gets access to the admin panel and any changes made take effect immediately rather than being affected by the caching procedure. Unauthenticated users will be blocked.

We are in the process of offering current Deflect users the opportunity to switch to the authenticated password system.

In the previous procedure, hiding the URL added an extra layer of security for the site since it made it much more difficult for hackers to guess the address (…/admin , /login etc) and brute force their way in using password-cracking software. Of course it is good practice to keep a secret URL address to increase security by one more layer, so we will always provide the option for new users to change their admin URL from the default address to a secret one.

Today’s announcement marks another stage in our goal to simplify every step of the Deflect signup procedure. Below is a preview of the new Dashboard, the first thing you will see after signing up and receiving your login details. Notice the magnificently reduced steps involved in becoming a full Deflectee.

Coming very soon!