Creating a simple password program in C++

[The_Inventor]

So I'm trying to teach myself C++ programming and I'm having trouble writing a password program.
Essentially I want to program to ask the user to input a password, and then compare that input with the correct password. If the user input matches the password I want the program to output a message saying "password accepted", if they do not match then I want the program to output a message saying "password invalid... Try again:" and from there the user continues to try a password until they input the correct password. This seemed simple at first however the problem arises when I try to introduce a while loop. If the password is incorrect after the second try they program continues to loop the message "password invalid...Try again:" without giving the user a chance to type in the password. Below is my source code, I'm using visual studio by the way. Can anyone help me out?

#include "stdafx.h"
#include <iostream>
#include <string>
#include <math.h>

using namespace std;

string Admission()
{
    string userinput;                    // this is the user's guess
    string password = "TonyStark";        // this is the actual password
    cout << "Enter password: ";
    cin >> userinput;
    if (userinput != password)
    {
        cout << "Password Invalid... Try Again: ";
        cin >> userinput;
        while (userinput != password)
            cout << "Password Invalid... Try Again" << endl;
            cin >> userinput;
    }
    else
        cout << "Password Accepted... ";
 
    return "Welcome";
}

int main()
{
    cout << Admission() << endl;

    system("pause>nul");
    return 0;
}

 

[haruspex]

Does this help: http://www.cplusplus.com/forum/articles/6046/?
I do see one clear error: you will only reach "password accepted" if it is right first time.

 

[Svein]

Your loop is in the wrong place. Try this:

  ...
do
  cout << "Enter password: ";
  cin >> userinput;
  if (userinput != password)
    cout << "Password Invalid... Try Again: ";
  while (userinput != password);
cout << "Password Accepted... ";
  ...

 

[haruspex]

while (userinput != password)
cout << "Password Invalid... Try Again" << endl;
cin >> userinput;

I see the problem now. The third statement above is not in the loop. You need {} braces.
(It would have been obvious with the right indentation.)

 

[The_Inventor]

I see the problem now. The third statement above is not in the loop. You need {} braces.
(It would have been obvious with the right indentation.)

Wow, such a simple mistake. It works now, thanks a lot!

 

[jedishrfu]

Also real password algorithms use hashing so that the password is always hidden. They hash the user input and compare it to the hashed password with matching hashes meaning passwords match.

 

[The_Inventor]

Also real password algorithms use hashing so that the password is always hidden. They hash the user input and compare it to the hashed password with matching hashes meaning passwords match.

Interesting, Is there a way to do this in C++? I've been learning this stuff on my own so there's many C++ commands, and tricks that I haven't been exposed to yet.

 

[haruspex]

Is there a way to do this in C++?

Of course, but some hashing algorithms are better than others. First, you have to decide what level of risk you will tolerate for an accidental match. Say you have a good algorithm with a 32 bit hash. Then the risk of an accidental match is one in 2³².
CRC32 is very good as an algorithm; there is a choice of polynomials.

 

[jedishrfu]

Wow, such a simple mistake. It works now, thanks a lot!

Sometimes the error creep in because of a misplaced semicolon:

for(int i=0; i<5; i++) ;       // the FOR loop runs 5 times executing the  empty semicolon statement
{
    printf("Hello World!");  // finally after the FOR loop completes then the print block prints Hello World
}

because I've done this in the past, I use the following brace formatting in my code:

for(int i=0; i<5; i++)  {
    printf("Hello World!");     // the FOR loop runs 5 times and prints Hello World 5 times as expected...
}

because seeing "; {" reminds me of a sad face ie it looks wrong when you see it.

 

[SixNein]

Of course, but some hashing algorithms are better than others. First, you have to decide what level of risk you will tolerate for an accidental match. Say you have a good algorithm with a 32 bit hash. Then the risk of an accidental match is one in 2³².
CRC32 is very good as an algorithm; there is a choice of polynomials.

In real world programming, you want to use an algorithm like SHA512, and you also want to have a random salt generated. You also need to set a minimum complexity required of the password itself.

The main factor in selecting an algorithm isn't accidental matches per say; instead, it is how fast someone can crack it using say rainbow tables. These days it's good practice to have a secondary means of authentication, i.e., two factor.

 

[jim mcnamara]

@SixNein - it is really common for inexperienced (and some who know better ) programmers to come up with methods or algorithms for tasks they have no good understanding (about). You know - The ones best handled by the libraries in the OS/language implementation - Passwords, authentication in general, date/time manipulations, hashing, etc.

I view the OP as purely a learner and assume nothing important will be behind the authentication. Maybe it is a way to block little brother/kid out of the system.

 

[brainierthaneinstein]

Don't forget to "salt" your hashes!

Hackers have rainbow tables that have the hashes for most well used passwords - if you salt the users password before performing the hash, then store the salt and the hash you'll be much safer and it doesn't add too much overhead

 

[jtbell]

I view the OP as purely a learner and assume nothing important will be behind the authentication.

Indeed, this reads like something that I might have given as a simple exercise during the first few weeks of a programming course, after covering the basics of console I/O, if-statements and loops. I would of course have told students that real password algorithms also involve encryption and are more sophisticated than this.

Crawling before walking before running before marathons.

 

[SixNein]

@SixNein - it is really common for inexperienced (and some who know better ) programmers to come up with methods or algorithms for tasks they have no good understanding (about). You know - The ones best handled by the libraries in the OS/language implementation - Passwords, authentication in general, date/time manipulations, hashing, etc.

I view the OP as purely a learner and assume nothing important will be behind the authentication. Maybe it is a way to block little brother/kid out of the system.

My response was mostly geared towards another poster of the thread although the OP may benefit from being aware of the existence of these ideas.

 

[rootone]

I have not got a lot to hide., it makes stuff too complicated.