fusion

History

Michael Lynch bfd4e8c66b Check passwords based on hashes rather than plaintext fusion's current password mechanism is vulnerable to a timing attack: https://en.wikipedia.org/wiki/Timing_attack Because fusion checks passwords using simple character-by-character string comparison, a password attempt that begins with the correct characters will take longer to evaluate than one that starts with incorrect characters. For example, if the correct password is 'platypus123' then a password attempt of 'plates' will take longer to evaluate than 'spoons' because 'plates' and 'platypus' share a common prefix. An attacker who attempts the password 'plates' will know that they likely have the correct prefix. To prevent the timing attack, this change hashes the user's password using PBKDF2 and compares hashes using subtle.ConstantTimeCompare, which is specifically designed to prevent timing attacks.	2025-01-12 11:31:01 -05:00
..
password.go	Check passwords based on hashes rather than plaintext	2025-01-12 11:31:01 -05:00
password_test.go	Check passwords based on hashes rather than plaintext	2025-01-12 11:31:01 -05:00

Michael Lynch bfd4e8c66b Check passwords based on hashes rather than plaintext

fusion's current password mechanism is vulnerable to a timing attack:

https://en.wikipedia.org/wiki/Timing_attack

Because fusion checks passwords using simple character-by-character string comparison, a password attempt that begins with the correct characters will take longer to evaluate than one that starts with incorrect characters. For example, if the correct password is 'platypus123' then a password attempt of 'plates' will take longer to evaluate than 'spoons' because 'plates' and 'platypus' share a common prefix. An attacker who attempts the password 'plates' will know that they likely have the correct prefix.

To prevent the timing attack, this change hashes the user's password using PBKDF2 and compares hashes using subtle.ConstantTimeCompare, which is specifically designed to prevent timing attacks.

2025-01-12 11:31:01 -05:00

password.go

Check passwords based on hashes rather than plaintext

2025-01-12 11:31:01 -05:00

password_test.go

Check passwords based on hashes rather than plaintext

2025-01-12 11:31:01 -05:00