Re:Show HN: CMS Server written in Go (alpha)
by wilsonfiifi on Saturday June 01, 2013 @07:10AM
(#5803534)
:-) put me on the spot! thanks for going through the code though.
security layer definitely needs more work. my choices were mostly limited by my haste to get a working prototype and not very well thought through.
No problem, thanks for sharing your project with everyone! Just people definitely like to use symbols in passwords.
Your fundamentals are fine, i don't think those are very serious problems compared to the average custom web app in the wild (most of which probably use plaintext passwords with no concern for sqli or xss...)
Re:Show HN: CMS Server written in Go (alpha)
by ryalfalpha on Saturday June 01, 2013 @01:19PM
(#5804908)
Haven't done much golang and don't have it installed on this laptop, but are string comparisons constant time?
If not, I think there is potential for a timing attack here?
if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }
Go does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.
Re:Show HN: CMS Server written in Go (alpha)
by wilsonfiifi on Saturday June 01, 2013 @03:00PM
(#5805405)
Thanks for pointing that out. Will look into it
Okay, why?
This caught my eye so i had a look through auth.go. Passwords are salted sha1... okay, but why not bcrypt? No PBKDF2? No field for hash format versioning if you want to backwards-compatible upgrade to bcrypt in future? Guess you could always go by the salt length or something.
It looks like your code to hash the password and salt is copy-pasted and appears twice, don't do that.
Your salts are 16 random bytes, okay.. but why base64 encode the salt before hashing? Now some structure of the content is known that might expose a weakness.