Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Using passwords with many special character points to a login loop #166

Closed
maschhoff opened this issue Apr 2, 2022 · 2 comments · Fixed by #167
Closed

Using passwords with many special character points to a login loop #166

maschhoff opened this issue Apr 2, 2022 · 2 comments · Fixed by #167

Comments

@maschhoff
Copy link

If you use many special character and generated passwords its ending up in a login loop
@maschhoff
Copy link
Author

Piko0(Ky8(Locy1=Cygih7§Rakar7 example

mtlynch added a commit that referenced this issue Apr 2, 2022
@mtlynch
Use PBKDF2 to hash shared secret
ae74394 
We were previously storing the password in plaintext as a cookie. This was insecure, but fairly low risk because in order to compromise the key, an attacker would need to compromise the user's browser (beyond XSS, as it's an HttpOnly key).

Storing the secret in plaintext additionally had the problem of not properly encoding characters that are not allowed in HTTP cookies.

This change hashes passwords with PBKDF2 and stores the result as base64-encoded bytes.

Fixes #166
@mtlynch mtlynch mentioned this issue Apr 2, 2022
Merged
mtlynch added a commit that referenced this issue Apr 2, 2022
@mtlynch
Use PBKDF2 to hash shared secret (#167)
d27d4db 
* Use PBKDF2 to hash shared secret

We were previously storing the password in plaintext as a cookie. This was insecure, but fairly low risk because in order to compromise the key, an attacker would need to compromise the user's browser (beyond XSS, as it's an HttpOnly key).

Storing the secret in plaintext additionally had the problem of not properly encoding characters that are not allowed in HTTP cookies.

This change hashes passwords with PBKDF2 and stores the result as base64-encoded bytes.

Fixes #166

* Fix error message
@mtlynch
Copy link
Owner

mtlynch commented Apr 2, 2022

Thanks for reporting this, @maschhoff! I'm going to cut a new release today that will fix this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Use PBKDF2 to hash shared secret mtlynch/picoshare
2 participants
@maschhoff @mtlynch