Repository navigation
Security of Network Discussion
The network has strong emphasis on the Privacy of a user. Messages are encrypted before being sent and can only be decrypted by the intended user. The network however lacks a bit on Consent as someone may message the client things that couldn’t be filtered out. Since local blocking and in-built filtering is present, this may result in a few cases of a user receiving messages they would rather not see. While functionality is present to block a user, it doesn’t prevent this sort of a situation till the other user is blocked. Security has been handled by my Database well. SQLite has been used and there is significant defense against injection attacks. The code has been written in such a way that error messages don’t cause the program to crash. Additionally, API-keys have been used and the use of sessions has been carried out. All information is destroyed once a user logs out. The session expires and can be reconfigured for a new log in.
One flaw that I believe exists is the limitation on database storage. I don’t know how much data a SQLite database can hold, but since we may have to store messages from numerous users on the chat history, it may eventually cause a crash. At the moment, my web-app isn't verifying signature of the function calls. This is a weak point and can allow people to send messages without have the right authentication to do so.
Impersonating another user seems unlikely as all the private data associated to a user is stored on the Login server. The process to retrieve to the private information is linked to a secondary password and increases security a lot. Therefore, a user actually needs two distinct passwords to log in. Without either one, either private data won’t be extracted or the user won’t be allowed to log in successfully.
The login server, however, is open to hacks in the real world. Since it contains sensitive information, it can be disastrous if the Login Server is broken. Also, even if the Login Server becomes temporarily disabled, it can halt the entire authentication process and the web-app is almost pointless at that point.
https://github.com/uoa-cs302/2019-Python-ddhy609/wiki/General-Discussion