5 ms·
> I believe the Ruby example is incorrect Unfortunately, there's nothing I can do about that, unless someone can point me to an alternative that uses a constan
by sarciszewski 11y ago
> I believe the Ruby example is incorrect
Unfortunately, there's nothing I can do about that, unless someone can point me to an alternative that uses a constant-time comparison.
I've left a comment on the pull request so that, hopefully, it can be merged.
> (and likely others)
Which others?
- astockwell 11y agoAfter re-reading the others in depth, all other examples appear to use appropriate comparison methods (knowing nothing of the underlying implementations). I've updated my comment to clarify. I see your team is actively posting on the bcrypt-ruby issue #119 as we speak, so I guess I'd say wait for the PR to merge, or manually implement the approach they've outlined to secure compare: https://github.com/codahale/bcrypt-ruby/pull/119/files https://github.com/codahale/bcrypt-ruby/pull/119/files