nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-05-13 10:30:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

No need to have avoid timing side-channel attack in user_add. We're just going to tell you if the user already exists anyway.

Browse Source
This commit is contained in:
James Valleroy 2013-11-04 02:37:12 +00:00 committed by Nick Daly
parent 96edae33ed
commit 2f7b56e6a9
2 changed files with 18 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/security.mdwn
View File

@ -8,7 +8,7 @@ Here is an overview of how user passwords are currently being stored in Plinth.
1. We check if the username or password is empty. If so, return an error message. 1. We check if the username or password is empty. If so, return an error message.
2. Use bcrypt (from passlib) to encrypt the password and generate a random salt. This step is performed regardless of whether the user already exists. 2. Use bcrypt (from passlib) to encrypt the password and generate a random salt.
3. If the password length is over 4096, bcrypt raises an exception. We catch this exception and return an error message. 3. If the password length is over 4096, bcrypt raises an exception. We catch this exception and return an error message.

8
modules/installed/lib/auth.py
View File

@ -24,17 +24,15 @@ def add_user(username, passphrase, name='', email='', expert=False):
if not passphrase: error = "Must specify a passphrase!" if not passphrase: error = "Must specify a passphrase!"
if error is None: if error is None:
# hash the password whether the user exists, to foil timing if username in map(lambda x: x[0], cfg.users.get_all()):
# side-channel attacks error = "User already exists!"
else:
try: try:
pass_hash = bcrypt.encrypt(passphrase) pass_hash = bcrypt.encrypt(passphrase)
except PasswordSizeError: except PasswordSizeError:
error = "Password is too long." error = "Password is too long."
if error is None: if error is None:
if username in map(lambda x: x[0], cfg.users.get_all()):
error = "User already exists!"
else:
di = { di = {
'username':username, 'username':username,
'name':name, 'name':name,