3 ms·
Timing attacks like you mention here are trivially easy to prevent. Step 1: Determine how long a query for a not found user may take... Let's say 1-2 seconds s
by iramiller 14y ago
Timing attacks like you mention here are trivially easy to prevent.
Step 1: Determine how long a query for a not found user may take... Let's say 1-2 seconds since there may be many rows to deal with.
Step 2: Multiply the value in step 1 by two or at least add a comfortable margin, perhaps 5 seconds total.
Step 3: On the start of the request performing the look up spawn a separate timing thread.
Step 4: At the end of the request join the timing thread.
This will tie the processing time of the request to the uniform time out value instead of your database processing delay.
- unreal37 14y agoI think Patrick's point is still valid here. Even if you try to even out the time it takes for a valid login, and an invalid login.... there will still be a detectable difference under certain circumstances based on site traffic even. Let's say a valid login takes 4.9 seconds, and you are able to rig an invalid login to take 5.0 seconds. You might think that is an imperceptible difference. But a determined hacker with a week can try your script a billion times, and get to statistical certainty that the email doesn't exist. Not sure WHY they'd ever want to go through so much effort for that info, but it's always going to be possible.
- gws 14y agoI think the idea is to rig both cases to return after the set timeout to make them undistinguishable (so both to return after 5.0 in your example). Of course the timeout has to be set above the worst case timing for a valid login
- StavrosK 14y agoWhy would they differ? Both take exactly 5 seconds, since you pad the difference anyway.
- Dylan16807 14y agoNo, trying to even out times by matching is not what was suggested. Instead you make a sleep mechanism that ends uniformly. In this example you would always sleep until the ten second mark, valid or invalid. Trying to make two code paths take the same time without waiting on an external timer is deep voodoo and should be left to experts.