News for hackers. Stuff that matters.

A comment on Show HN: Userbase – Add user accounts and persistence to your static site.

Re:Show HN: Userbase – Add user accounts and persistence to ... by tuxxy on Saturday January 25, 2020 @03:15PM (#22148384)
I took a cursory look at the crypto on the backend, and it was mildly concerning. It appears to not be using modern asymmetric primitives. At first glance, it's not insecure or anything... just old[0].

Rather than using something like libsodium's public-key box API, which is wonderful, it's using a 2048-bit Diffie-Hellman Prime group. This isn't really great. You should definitely upgrade to more modern primitives. I can highly suggest libsodium as a drop-in replacement.

The other thing about this that's more concerning is that I have no idea if there is any validation going on to prevent small subgroup confinement attacks on this, but I don't really want to spend anymore free time checking this out and I'll leave it as an exercise for the reader/author.

Personally, I wouldn't use this product until a few cryptography design decisions were changed. If you're marketing this as a privacy-centric product, there's a lot of work to be done--not just on the Diffie-Hellman usage.

0. https://github.com/encrypted-dev/userbase/blob/master/src/us...

[ Parent | on HN ]
Re:Show HN: Userbase – Add user accounts and persistence to ... by prophesi on Saturday January 25, 2020 @04:06PM (#22148618)
Old isn't a valid critique with crypto; 2048-bit DH is verifiably secure.
[ Parent | on HN ]
Re:Show HN: Userbase – Add user accounts and persistence to ... by j-berman on Saturday January 25, 2020 @04:59PM (#22148891)
I thought that old + verifiably secure combine for the safest property in a crypto algorithm
[ Parent | on HN ]
Re:Show HN: Userbase – Add user accounts and persistence to ... by tuxxy on Monday January 27, 2020 @06:07AM (#22158289)
Old is entirely a valid critique of crypto; it demonstrates the authors aren't familiar with modern privacy tooling which tells me a lot.
[ Parent | on HN ]
Re:Show HN: Userbase – Add user accounts and persistence to ... by j-berman on Monday January 27, 2020 @02:00PM (#22162569)
We looked at libsodium and its choices impacted our discussions on our system. We decided not to use it because it's not compatible with many browsers [0]

We also discussed using a modern asymmetric key algorithm. We decided on Diffie-Hellman because we were extremely confident it's secure (so long as we choose the right parameters and implement it correctly), and would be very simple to fit it into our architecture.

[0] https://github.com/jedisct1/libsodium.js/#compatibility

[ Parent | on HN ]
Re:Show HN: Userbase – Add user accounts and persistence to ... by prophesi on Tuesday January 28, 2020 @03:02PM (#22173484)
I know this thread's a bit old now, but could you expound on what the implications are for that?
[ Parent | on HN ]
Re:Show HN: Userbase – Add user accounts and persistence to ... by DVassallo on Saturday January 25, 2020 @03:36PM (#22148482)
We’re marketing this as something that can significantly reduce personal data misuse compared to having user data sitting in clear in a MySQL database. The value-add is mainly to the developers. (Although the devs can choose to promote some of that to their users too.)
[ Parent | on HN ]
Re:Show HN: Userbase – Add user accounts and persistence to ... by sarakayakomzin on Saturday January 25, 2020 @03:45PM (#22148517)
https://blog.intothesymmetry.com/2020/01/the-curious-case-of...

seems like it'll break on firefox now.

[ Parent | on HN ]
Re:Show HN: Userbase – Add user accounts and persistence to ... by j-berman on Saturday January 25, 2020 @04:14PM (#22148655)
We don't use WebCrypto for DH, we're using this npm package:

https://github.com/crypto-browserify/diffie-hellman/blob/mas...

[ Parent | on HN ]