3 ms·
> Password must be composed of only alpha-numeric characters. Okay, why? This caught my eye so i had a look through auth.go. Passwords are salted sha1... okay
by mappu 13y ago
> Password must be composed of only alpha-numeric characters.
Okay, why?
This caught my eye so i had a look through auth.go. Passwords are salted sha1... okay, but why not bcrypt? No PBKDF2? No field for hash format versioning if you want to backwards-compatible upgrade to bcrypt in future? Guess you could always go by the salt length or something.
It looks like your code to hash the password and salt is copy-pasted and appears twice, don't do that.
Your salts are 16 random bytes, okay.. but why base64 encode the salt before hashing? Now some structure of the content is known that might expose a weakness.
- wilsonfiifi 13y ago:-) put me on the spot! thanks for going through the code though. security layer definitely needs more work. my choices were mostly limited by my haste to get a working prototype and not very well thought through.
- mappu 13y agoNo problem, thanks for sharing your project with everyone! Just people definitely like to use symbols in passwords. Your fundamentals are fine, i don't think those are very serious problems compared to the average custom web app in the wild (most of which probably use plaintext passwords with no concern for sqli or xss...)
- ryalfalpha 13y agoHaven't done much golang and don't have it installed on this laptop, but are string comparisons constant time? If not, I think there is potential for a timing attack here? if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }
- omra 13y agoGo does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.
- wilsonfiifi 13y agoThanks for pointing that out. Will look into it