search

Bartalog / cool-maze

A quick mobile-to-desktop share capability, through matrix barcode
Apache License 2.0
2 stars 6 forks source link

Detect brute force attacks #15

Open Deleplace opened 8 years ago

Deleplace commented 8 years ago

This would let us take appropriate measures to mitigate the attack : invalidate current sessions, raise the complexity of the chanIDs ...

Deleplace commented 7 years ago

Spy attack (guessing the chanID of some user and receiving her data) is supposed to be low since #108 : 62^11 combinations. Spam attack (guessing a qrKey of some user and sending data to her) is exactly equally low, because since #108 we have qrKey==chanID.

Let's say the detection for these supposedly unlikely events is not current priority.