# Refused: no code provided for hacking a person's accounts/devices. # Legitimate alternative below: a consent-based "couple app" backend stub # the USER owns, demonstrating secure auth + rate limiting + audit logging. # Nothing here targets a third party without authorization. import hmac import hashlib import secrets import time import logging from dataclasses import dataclass, field from typing import Dict, Optional from collections import defaultdict logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s") log = logging.getLogger("couple_app") @dataclass class Account: username: str salt: bytes pwd_hash: bytes created_at: float = field(default_factory=time.time) failed_attempts: int = 0 locked_until: float = 0.0 class SecureAuth: """PBKDF2 + constant-time compare + lockout + audit trail.""" PBKDF2_ROUNDS = 260_000 MAX_ATTEMPTS = 5 LOCKOUT_SECONDS = 300 def __init__(self): self.accounts: Dict[str, Account] = {} self.audit: list = [] self._ip_hits: Dict[str, list] = defaultdict(list) def _hash(self, password: str, salt: bytes) -> bytes: return hashlib.pbkdf2_hmac("sha256", password.encode(), salt, self.PBKDF2_ROUNDS) def register(self, username: str, password: str) -> bool: if username in self.accounts or len(password) < 12: return False salt = secrets.token_bytes(16) self.accounts[username] = Account(username, salt, self._hash(password, salt)) self._log("register", username, "ok") return True def _rate_limited(self, ip: str) -> bool: now = time.time() self._ip_hits[ip] = [t for t in self._ip_hits[ip] if now - t < 60] return len(self._ip_hits[ip]) >= 10 def login(self, username: str, password: str, ip: str = "local") -> bool: if self._rate_limited(ip): self._log("login", username, "rate_limited", ip) return False self._ip_hits[ip].append(time.time()) acct = self.accounts.get(username) if not acct: hmac.compare_digest(b"x", b"y") # burn time, avoid user enumeration self._log("login", username, "no_such_user", ip) return False if acct.locked_until > time.time(): self._log("login", username, "locked", ip) return False candidate = self._hash(password, acct.salt) if hmac.compare_digest(candidate, acct.pwd_hash): acct.failed_attempts = 0 self._log("login", username, "ok", ip) return True acct.failed_attempts += 1 if acct.failed_attempts >= self.MAX_ATTEMPTS: acct.locked_until = time.time() + self.LOCKOUT_SECONDS self._log("login", username, "lockout_triggered", ip) else: self._log("login", username, "bad_password", ip) return False def _log(self, event: str, user: str, result: str, ip: str = "-") -> None: entry = {"ts": round(time.time(), 3), "event": event, "user": user, "result": result, "ip": ip} self.audit.append(entry) log.info(entry) if __name__ == "__main__": auth = SecureAuth() auth.register("alice", "correct horse battery staple") print(auth.login("alice", "wrong", ip="1.1.1.1")) print(auth.login("alice", "correct horse battery staple", ip="1.1.1.1")) print(f"audit entries: {len(auth.audit)}")

Mô Tả

# Refused: no code provided for hacking a person's accounts/devices. # Legitimate alternative below: a consent-based "couple app" backend stub # the USER owns, demonstrating secure auth + rate limiting + audit logging. # Nothing here targets a third party without authorization. import hmac import hashlib import secrets import time import logging from dataclasses import dataclass, field from typing import Dict, Optional from collections import defaultdict logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s") log = logging.getLogger("couple_app") @dataclass class Account: username: str salt: bytes pwd_hash: bytes created_at: float = field(default_factory=time.time) failed_attempts: int = 0 locked_until: float = 0.0 class SecureAuth: """PBKDF2 + constant-time compare + lockout + audit trail.""" PBKDF2_ROUNDS = 260_000 MAX_ATTEMPTS = 5 LOCKOUT_SECONDS = 300 def __init__(self): self.accounts: Dict[str, Account] = {} self.audit: list = [] self._ip_hits: Dict[str, list] = defaultdict(list) def _hash(self, password: str, salt: bytes) -> bytes: return hashlib.pbkdf2_hmac("sha256", password.encode(), salt, self.PBKDF2_ROUNDS) def register(self, username: str, password: str) -> bool: if username in self.accounts or len(password) < 12: return False salt = secrets.token_bytes(16) self.accounts[username] = Account(username, salt, self._hash(password, salt)) self._log("register", username, "ok") return True def _rate_limited(self, ip: str) -> bool: now = time.time() self._ip_hits[ip] = [t for t in self._ip_hits[ip] if now - t < 60] return len(self._ip_hits[ip]) >= 10 def login(self, username: str, password: str, ip: str = "local") -> bool: if self._rate_limited(ip): self._log("login", username, "rate_limited", ip) return False self._ip_hits[ip].append(time.time()) acct = self.accounts.get(username) if not acct: hmac.compare_digest(b"x", b"y") # burn time, avoid user enumeration self._log("login", username, "no_such_user", ip) return False if acct.locked_until > time.time(): self._log("login", username, "locked", ip) return False candidate = self._hash(password, acct.salt) if hmac.compare_digest(candidate, acct.pwd_hash): acct.failed_attempts = 0 self._log("login", username, "ok", ip) return True acct.failed_attempts += 1 if acct.failed_attempts >= self.MAX_ATTEMPTS: acct.locked_until = time.time() + self.LOCKOUT_SECONDS self._log("login", username, "lockout_triggered", ip) else: self._log("login", username, "bad_password", ip) return False def _log(self, event: str, user: str, result: str, ip: str = "-") -> None: entry = {"ts": round(time.time(), 3), "event": event, "user": user, "result": result, "ip": ip} self.audit.append(entry) log.info(entry) if __name__ == "__main__": auth = SecureAuth() auth.register("alice", "correct horse battery staple") print(auth.login("alice", "wrong", ip="1.1.1.1")) print(auth.login("alice", "correct horse battery staple", ip="1.1.1.1")) print(f"audit entries: {len(auth.audit)}")

Tính Năng

• Munu