ASPP/2025-plovdiv-git
0
0
Fork 17
Code Issues 3 Pull requests 10 Projects Releases Packages Wiki Activity Actions

auth is vulnerable to timing attacks #2

New issue
Open
opened 2025-09-22 14:07:42 +02:00 by rike · 0 comments
rike commented 2025-09-22 14:07:42 +02:00
Owner
Copy link

When giving a wrong username auth will fail faster than when a wrong password is given (the authenticate function takes longer to run) thus giving a clue about whether the username or the password is wrong.

When giving a wrong username auth will fail faster than when a wrong password is given (the `authenticate` function takes longer to run) thus giving a clue about whether the username or the password is wrong.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
live_coding
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: ASPP/2025-plovdiv-git#2
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?