为什么在密码检查中将time.sleep与random.expovariate一起使用?

时间:2020-02-03 18:58:48

标签: python python-3.x

在此代码段中使用Option Explicit Sub HighlightDuplicates() Dim ws As Worksheet, t0 As Single, t1 As Single Set ws = ThisWorkbook.Sheets("Sheet1") t0 = Timer 'Step 4: Otherwise, a cell should not be highlighted. ws.Cells.ClearFormats Const RANGE_A As String = "B1:E2000" Const RANGE_B As String = "G1:G2000" Const RANGE_C As String = "I1:AH2000" Dim dictA As Object, dictB As Object, dictC As Object Set dictA = CreateObject("Scripting.Dictionary") Set dictB = CreateObject("Scripting.Dictionary") Set dictC = CreateObject("Scripting.Dictionary") Call buildDict(dictA, ws.Range(RANGE_A)) Call buildDict(dictB, ws.Range(RANGE_B)) Call buildDict(dictC, ws.Range(RANGE_C)) 'Step 1: If a cell appears in Range A and Range C highlighted yellow. 'Step 2: Then, if a cell appears in Range A and Range B, 'I want them highlighted green. Dim cell As Range, key As String For Each cell In ws.Range(RANGE_A) If Len(cell.Value) > 0 Then key = CStr(cell.Value) If dictC.exists(key) Then cell.Interior.Color = vbYellow If dictB.exists(key) Then cell.Interior.Color = vbGreen End If Next For Each cell In ws.Range(RANGE_C) If Len(cell.Value) > 0 Then key = CStr(cell.Value) If dictA.exists(key) Then cell.Interior.Color = vbYellow End If Next For Each cell In ws.Range(RANGE_B) If Len(cell.Value) > 0 Then key = CStr(cell.Value) If dictA.exists(key) Then cell.Interior.Color = vbGreen End If Next 'Step 3: Then, if a cell appears in Range B and more than twice in Range C, 'I want them highlighted red. For Each cell In ws.Range(RANGE_B) If Len(cell.Value) > 0 Then key = CStr(cell.Value) If dictC.exists(key) Then If dictC.Item(key) > 2 * dictB.Item(key) Then cell.Interior.Color = vbRed End If End If End If Next For Each cell In ws.Range(RANGE_C) If Len(cell.Value) > 0 Then key = CStr(cell.Value) If dictB.exists(key) Then If dictC.Item(key) > 2 * dictB.Item(key) Then cell.Interior.Color = vbRed End If End If End If Next t1 = Timer MsgBox "Completed in " & Int(t1 - t0) & " seconds" End Sub Sub buildDict(ByRef dict, ByRef rng) Dim cell As Range, key As String For Each cell In rng If Len(cell.Value) > 0 Then key = CStr(cell.Value) If Not dict.exists(key) Then dict.Add key, 1 Else dict.Item(key) = dict.Item(key) + 1 End If End If Next Debug.Print "Keys in " & rng.Address, dict.Count End Sub 函数的目的是什么

time.sleep()

1 个答案:

答案 0 :(得分:3)

这是一种尝试在验证密码时引入随机时间延迟的方法,大概是为了对付timing attacks,在这种情况下,攻击者利用错误的密码导致更快的响应这一事实。

我不希望这会有用。 secrets.compare_digest()已经采取一切适当措施来减轻定时攻击。如果hashpasstarget_hash_pass具有相同的类型(总是字节或者都是字符串)并且长度相等,则通常的定时攻击向量在这里不可用。

但是,可能是作者不相信这两个条件总是正确的。 user_info结构可能包含较短或更长时间的密码散列,或者您可能会得到不同的类型。如果是这样,那么应该直接解决这些问题。

应该注意的是,由于定时攻击会使用不同的密码比较多次尝试之间的统计差异,因此随机噪声只会稍微降低此类攻击的速度;无论网络连接和正常的计算机操作已经增加了什么时间差异,它只会增加更多的噪音。请参阅Can I prevent timing attacks with random delays?Could a random sleep prevent timing attacks?。更糟糕的是,该代码使用标准的random随机数生成器,该生成器在密码上并不安全,因此,如果确定了足够的攻击者,就可以考虑睡眠的变化。

我强烈建议作者删除该行,在此不提供任何实际的安全性。