3 ms·
No problem, thanks for sharing your project with everyone! Just people definitely like to use symbols in passwords. Your fundamentals are fine, i don't think t
by mappu 13y ago
No problem, thanks for sharing your project with everyone! Just people definitely like to use symbols in passwords.
Your fundamentals are fine, i don't think those are very serious problems compared to the average custom web app in the wild (most of which probably use plaintext passwords with no concern for sqli or xss...)
- ryalfalpha 13y agoHaven't done much golang and don't have it installed on this laptop, but are string comparisons constant time? If not, I think there is potential for a timing attack here? if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }
- omra 13y agoGo does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.
- wilsonfiifi 13y agoThanks for pointing that out. Will look into it