3 ms·
I'm really at loss at what problem you're trying to solve here, what your algorithm is doing, and where/for how long the mentioned files are stored and who's in
by anonymouz 14y ago
I'm really at loss at what problem you're trying to solve here, what your algorithm is doing, and where/for how long the mentioned files are stored and who's involved in the transaction? Who's holding which files? For how long?
I can only guess that the rawTransforms.json and userHashTransform.json are kept by some server, and the user is then authenticated against this? If so, why not use some standard method? (bcrypt, scrypt?)
In any case, creating your own hash function or making up your own secure authentication procedure should generally be considered a big red flag. Chances are, whatever authentication issue you're trying to solve, there is already a standard way for it: Stick to it.
Remember: It's trivial to create a security scheme you cannot break, but very hard to create one that somebody else cannot break.
- alhenaadams 14y agoI am trying let people login to a site hosted on/as a github pages site. A client side only site with authentication. A single javascript file the can add this feature to my projects. i'm trying to create a homomorphic authentication system where no server ever stores any data about the user. your data never leaves your client. user data gets stored within the client itself custom encrypted for each user by their username, password, and hash. If I change the additions in my algorithm to multiplications I can avoid some issues others have pointed out.
- anonymouz 14y agoMultiplication instead of addition in the hash will give you the same problems. I'm not familiar with Github pages, but it seems one cannot store anything on the server-side, it's just HTML+JS. If nothing is sent to any server, there does not seem anything to authenticate or protect from anyone.