3 ms·
If you use a proper HMAC then it's fine. Looks like they just choose an egregiously bad way to verify the messages.
by db48x 9y ago
If you use a proper HMAC then it's fine. Looks like they just choose an egregiously bad way to verify the messages.
- nothrabannosir 9y agoHmac libraries expect the message to be a string. It protects you against length extension attacks (& co). This was a bug in how they converted a map(string -> string) to a single string to sign. Hmac or not, you'd still need that, and if your bug is in there, no hmac will protect you.