search

SecureSECO / SearchSECOController

GNU Affero General Public License v3.0
6 stars 8 forks source link

Encrypt traffic between DB and Controller #20

Open slingerbv opened 2 years ago

slingerbv commented 2 years ago

Communication between controller and database-api, as well as between multiple database-api’s, is currently unencrypted in plain text. It would be trivial to send data to the database-api from any system, and possibly to find and exploit vulnerabilities in the database-api to hack a system running it.

developerfred commented 2 years ago

@slingerbv I want to work on this activity

slingerbv commented 2 years ago

@slingerbv I want to work on this activity

Great DeveloperFred! If you've seen the specs and all, feel free to get started. I'll block this issue and the other encryption issue for you. Curious to hear what you think of the code!

developerfred commented 2 years ago

@slingerbv I want to work on this activity

Great DeveloperFred! If you've seen the specs and all, feel free to get started. I'll block this issue and the other encryption issue for you. Curious to hear what you think of the code!

Perfect!

As I only explored SearchSecoController, I still haven't been able to point out improvements, but looking at everything superficially, I believe that we can improve the architecture of the project's components. I will see some architectures to suggest the ideal one for the project.

slingerbv commented 2 years ago

Yeah, and stick to the essential: the encryption. Right now all nodes communicate with each other and the DB without encryption, so ugly things could happen.

slingerbv commented 2 years ago

Looking forward to all your input!

On Sat, Aug 27, 2022 at 3:42 PM codingsh @.***> wrote:

@slingerbv https://github.com/slingerbv I want to work on this activity

Great DeveloperFred! If you've seen the specs and all, feel free to get started. I'll block this issue and the other encryption issue for you. Curious to hear what you think of the code!

As I only explored SearchSecoController, I still haven't been able to point out improvements, but looking at everything superficially, I believe that we can improve the architecture of the project's components. I will see some architectures to suggest the ideal one for the project.

— Reply to this email directly, view it on GitHub https://github.com/SecureSECO/SearchSECOController/issues/20#issuecomment-1229194903, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAERHLCFGVMPV37JYXNUZOTV3ILNHANCNFSM57AWNKDA . You are receiving this because you were mentioned.Message ID: @.***>

-- dr. Slinger Jansen (Roijackers) Do you want to secure software ecosystems https://secureseco.org/ with us? Software Production Research Group https://www.uu.nl/en/research/software-systems/organization-and-information , Utrecht University http://www.slingerjansen.nl +31 6 19 884 880 book me through YouCanBook.me http://slingerroijackers.YouCanBook.me

gitcoinbot commented 1 year ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

Work has been started.

These users each claimed they can complete the work by 4 days, 14 hours from now. Please review their action plans below:

1) ginanisque has been approved to start work.

I would love to work on this bounty. I'm ready to help encrypt the communication between the two modules.

Learn more on the Gitcoin Issue Details page.

ginanisque commented 1 year ago

Hello @slingerbv . I see this project has to be submitted in Hi @slingerbv. i noticed the submission cutoff date for this bounty is in two days. I'm still working on it and am unlikely to finish within two days. Could you extend the expiration date?

ginanisque commented 1 year ago

Pls extend the expiration by a week. Thanks.

slingerbv commented 1 year ago

Done!

On Fri, Sep 23, 2022 at 2:14 PM ginanisque @.***> wrote:

Pls extend the expiration by a week. Thanks.

— Reply to this email directly, view it on GitHub https://github.com/SecureSECO/SearchSECOController/issues/20#issuecomment-1256135341, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAERHLALYNX4OCZACTGRCC3V7WNKVANCNFSM57AWNKDA . You are receiving this because you were mentioned.Message ID: @.***>

-- dr. Slinger Jansen (Roijackers) Do you want to secure software ecosystems https://secureseco.org/ with us? Software Production Research Group https://www.uu.nl/en/research/software-systems/organization-and-information , Utrecht University http://www.slingerjansen.nl +31 6 19 884 880 book me through YouCanBook.me http://slingerroijackers.YouCanBook.me