Whereas you don't publish the divisors and remainders used to check each field, the fact that a correct field is highlighted in green on completion means that the experimentation required to crack these values is very light. It takes less than half an hour to crack the whole system. I would force the user to finish entering all 12 characters before giving the green (or red) light.

I think you misunderstand my intent with this coding scheme. The fact that it's trivially easy for someone to generate a "well formed" code (i.e.: a code that makes all the boxes go green) is irrelevant. An organisation using this system would generate a code and then a) store it in their database and b) send it to their customer. Ultimately the only thing that matters is that the customer enters a code which is in the database.

The main purpose of the coloured highlighting is to alert the user that they have entered a sequence of characters which cannot possibly be part of a valid code. The client-side implementation might only use the red highlight (meaning "definitely wrong") and not bother with the green (meaning "possibly right").

An 'attacker' could definitely generate random codes and calculate valid checksums for them so that all the boxes were green (or at least not red); but that would do them no good because the chances of generating a code which happens to be in the database are slim (there are about 35 trillion possible 3-part codes).

I suggest also changeing the divisors and remainders when you have secured the system.

That sounds like an attempt at "security through obscurity". Which of course is doomed to fail since the client-side Javascript routines would need to know the correct values.

In reply to Re^2: RFC: Algorithm::CouponCode by grantm
in thread RFC: Algorithm::CouponCode by grantm

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.