News for hackers. Stuff that matters.

A comment on Show HN: Haven – Run a private website to share with only the people you choose. Parent comment

Re:Show HN: Haven – Run a private website to share with only... by cratermoon on Wednesday February 03, 2021 @03:13PM (#26018515)
Found the code. Looks like basic auth. And, I can't find any password hashing -- are they being stored in the clear?

Also the author checked in a credentials and a master key to github

[ Parent | on HN ]
Re:Show HN: Haven – Run a private website to share with only... by mawise on Wednesday February 03, 2021 @09:33PM (#26021905)
I'm using Rails Devise[1] for user auth, and http basic auth for RSS. RSS Basic auth credentials are always auto-generated, and don't give access to anything other than fetching the RSS feed.

Rails uses the "master key" to let you check in encrypted database credentials. I don't use that but Rails still requires a key for deployment--so I just checked in a key. Rails is really designed for a codebase that matches to a single deployment so this is a bit of a workaround.

[1] https://github.com/heartcombo/devise

[ Parent | on HN ]
Re:Show HN: Haven – Run a private website to share with only... by cratermoon on Wednesday February 03, 2021 @11:58PM (#26022765)
> I don't use that but Rails still requires a key for deployment--so I just checked in a key

It's safe to bet that someone will deploy this and use that master key instead of generating their own.

[ Parent | on HN ]
Re:Show HN: Haven – Run a private website to share with only... by hanniabu on Wednesday February 03, 2021 @04:55PM (#26019682)
Yikes, huge red flags....
[ Parent | on HN ]
Re:Show HN: Haven – Run a private website to share with only... by jgjot-singh on Thursday February 04, 2021 @06:19AM (#26024451)
How long did it take you to discern all that?
[ Parent | on HN ]