4 ms·
How about this: if database.contains(email) or md5sum(secretSalt + email).startsWith('4'): print "An email has been sent to this address with furth
by finnw 14y ago
How about this:
if database.contains(email) or md5sum(secretSalt + email).startsWith('4'):
print "An email has been sent to this address with further instructions"
else:
print "Sorry, this address does not exist in our database"
Now one in 16 (pseudo-randomly selected) emails will appear to be in the database, whether or not it is really there.
The attacker will still see the "confirmation" when they enter the victim's email address, but they cannot know if it was really in the database or if it was one of those random false positives.
- lvh 14y agoTiming attack vulnerability. A negative containment check is probably faster (at least statistically measurably so) than a positive one, so you'll see three peaks: - contained - false positive - not contained Probably with the first two being close together and the latter two being close together.