Known security risks - Githubissues

3meters / patchr-ios

Next incarnation of Patchr for iOS

1 stars 0 forks source link

Open Jaymassena opened 7 years ago

Jaymassena commented 7 years ago

This is used for now to track known gaps in our security.

Jaymassena commented 7 years ago

Invites do not expire: We could add an expiration timestamp and require that now <= timestamp for an invite to be considered valid for group/channel membership.
Invites can be forwarded: They are like golden tickets that can be used by anyone who possesses it but it can only be used once.
We rely on firebase security throttling to protect against massive user account spamming.

Jaymassena commented 6 years ago

As of 2.2

Branch invite links are good forever: We could add an expiration timestamp and require that now <= timestamp for an invite to be considered valid for channel membership. We could also use a branch feature that make a link good for one use only.
Branch invite links can be forwarded: They are like golden tickets that can be used by anyone who possesses it.
We rely on firebase security throttling to protect against massive user account spamming.