Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The "encryption" class does nothing of value #56

Closed
NickBorgers opened this issue Jan 19, 2019 · 1 comment
Closed

The "encryption" class does nothing of value #56

NickBorgers opened this issue Jan 19, 2019 · 1 comment

Comments

@NickBorgers
Copy link

const encoding = ',2YE6=#r(z5?Y4=a';

The variable called "encoding" is actually the password used to derive the cryptographic key, which is both static across all installations and published on GitHub. This means it provides no value; all someone viewing the ciphertext needs to do is lookup this project and extract the key.

Incidentally using AES without an initialization vector appears to have been deprecated by node, but I wouldn't bother fixing that unless some form of localized key generation can be established.

I don't know what the purpose of this encryption was, but it's not fulfilling it.

@Einstein42
Copy link
Contributor

Correct, this is on the todo list. Encryption is currently not implemented.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants