roundup-tracker / roundup / 38199460947

75%

Build Type

push

github

Committed by rouilj

Commit Message

bug: use hmac.compare_digest() for password comparisons

Replace == with hmac.compare_digest() to defeat timing attack.

This isn't a problem for the normal use case. Comparing two
salted/hashed passwords doesn't provide info to the attacker about the
underlying secret.

However if a password is stored with the plaintext "hash", the secret
could be derived. (One such use of plaintext would be to store the
seed for TOTP/HOTP second factor authentication. However this password
is never compared in normal use.)

Coverage Stats

3 of 3 new or added lines in 1 file covered. (100.0%)

115 existing lines in 3 files now uncovered.

19037 of 25443 relevant lines covered (74.82%)

5.21 hits per line