FUDforum
Fast Uncompromising Discussions. FUDforum will get your users talking.

Home » FUDforum » FUDforum Suggestions » Login filter for aliases as well?
Show: Today's Messages :: Unread Messages :: Show Polls :: Message Navigator
| Subscribe to topic | Bookmark topic 
Switch to threaded view of this topic Create a new topic Submit Reply
Login filter for aliases as well? [message #16733] Sun, 15 February 2004 19:23 Go to next message
Olliver   Germany
Messages: 443
Registered: March 2002
Karma: 0
Senior Member
add to buddy list
ignore all messages by this user
I came upon this by playing around with my test installation. The login filter with its regexp capacity is a great help however it can be easily tricked:

Supposed "jerk" is considerred an undesired word on a forum

User X register as "harmless", because he already became aware of the filter. He then chooses "The admin is a jerk" as alias:

Result: Trolling around as "The admin is a jerk" despite "jerk" being in the filter. I know, aliases can be turned off, but that's not a satisfying solution. Would it be feasible to use the login filter for both login and aliases? This way it couldn't be bypassed any longer without the necessity of turning it off.

Olliver
Re: Login filter for aliases as well? [message #16741 is a reply to message #16733] Mon, 16 February 2004 10:49 Go to previous messageGo to next message
Ilia is currently offline  Ilia   Canada
Messages: 13241
Registered: January 2002
Karma: 0
Senior Member
Administrator
Core Developer
add to buddy list
ignore all messages by this user
Human creativity knows no bounds people seeking to bypass filters could always use spaces, l33t speak etc... to trick filters.

For example I could enter Adm1n is a j3rk or just plain j3rk and it would not trigger the filter.


FUDforum Core Developer
Re: Login filter for aliases as well? [message #16743 is a reply to message #16741] Mon, 16 February 2004 14:05 Go to previous messageGo to next message
Olliver   Germany
Messages: 443
Registered: March 2002
Karma: 0
Senior Member
add to buddy list
ignore all messages by this user
regarding spaces, underscores, dots or numbers you can create regexps like for instance:
f[ ._\-]{0,1}u[ ._\-]{0,1}c[ ._\-]{0,1}k[[:print:] ]+

But ok. One could use some more spaces and in the end you got such a wide scope that you lock out almost anyone. Maybe you're right in the sense that in critical environments aliases shouldn't be activated at all despite their usefulness in general.

Olliver
Re: Login filter for aliases as well? [message #16744 is a reply to message #16743] Mon, 16 February 2004 14:08 Go to previous messageGo to next message
Ilia is currently offline  Ilia   Canada
Messages: 13241
Registered: January 2002
Karma: 0
Senior Member
Administrator
Core Developer
add to buddy list
ignore all messages by this user
I will make the alias go through the login filter, this is something that should be done. But, I think it is important to keep in mind that bypassing string filters is WAY easier then implementing them. Even you regex won't solve all problems.

For example instead of e I could use e with an accent or put - between words etc... possibilities are endless Smile


FUDforum Core Developer
Re: Login filter for aliases as well? [message #16749 is a reply to message #16744] Mon, 16 February 2004 15:57 Go to previous message
Olliver   Germany
Messages: 443
Registered: March 2002
Karma: 0
Senior Member
add to buddy list
ignore all messages by this user
Thanks for considering it. Smile
Ilia wrote on Mon, 16 February 2004 20:08

But, I think it is important to keep in mind that bypassing string filters is WAY easier then implementing them. Even you regex won't solve all problems.

that's why I pointed out above that some more spaces whatsoever drops us back to square one.

Quote:

For example instead of e I could use e with an accent or put - between words etc... possibilities are endless Smile

Sure is. But not all people are that creative as you are, luckily Smile

Thanks for your work
Olliver
Quick Reply
Formatting Tools:   
  Switch to threaded view of this topic Create a new topic
Previous Topic: two small things which could be improved...
Next Topic: Polls, do not like how they are handled...
Goto Forum:
  

-=] Back to Top [=-
[ Syndicate this forum (XML) ] [ RSS ]

Current Time: Sat Oct 21 02:57:58 EDT 2017

Total time taken to generate the page: 0.00767 seconds