paul-sh

3 ms·

1. 1.▲
   by paul-sh 11y ago

   I think you use this to validate the password, not to check the integrity of the message. And an attacker gets a password as a result of brute-forcing, not a hash. Look at this snippet in pseudocode: // Get the hash and the
2. 2.▲
   by paul-sh 11y ago

   The site compares MACs in the client's browser, so a timing attack is not really an issue here.
3. 3.▲
   by paul-sh 11y ago

   Ikkez, you use hash == HMAC-SHA256(CT, SHA256(password)) to check if the password is valid. You should replace the "SHA256(password)" part here with a strong password-based key derivation function (PBKDF2, scrypt, bcrypt) with a d
4. 4.▲
   by paul-sh 11y ago

   You shouldn't have minified the code, let people check what's going on.