Show HN: Passbolt – open-source password manager for teams

Re:Show HN: Passbolt – open-source password manager for teams by sweis on Wednesday April 27, 2016 @02:04PM (#11582901)

I haven't found it in the code yet, but the landing page's protocol diagram with optional "/auth/verify" might have potential to be abused as a decryption oracle. It depends how they check the nonce.

[ Parent | on HN ]

Re:Show HN: Passbolt – open-source password manager for teams by remy_ on Wednesday April 27, 2016 @02:16PM (#11583037)

The authentication token follows a very specific pattern to prevent this type of attacks. For example an authentication token would look like this: gpgauthv1.3.0|36|8661be60-23df-11e5-b16c-0002a5d5c51b|gpgauthv1.3.0. Both the server and client check for the consistency of that format.

[ Parent | on HN ]

Re:Show HN: Passbolt – open-source password manager for teams by sweis on Wednesday April 27, 2016 @02:25PM (#11583139)

Got it. Here's the code: https://github.com/passbolt/passbolt/blob/master/app/Control...

I didn't know gpgauth existed, but this is what they appear to be using (the site has a broken cert): https://gpgauth.org/

[ Parent | on HN ]