search

richardpenman / browsercookie

GNU Lesser General Public License v2.1
118 stars 27 forks source link

The salt should not be static. #27

Open cryptochecktool opened 6 days ago

cryptochecktool commented 6 days ago

The salt should not be set as a static variable, as this will lead to reduced security. See https://github.com/richardpenman/browsercookie/blob/9d5e80788504c8b950bda31e377585252d7abc31/browsercookie/init.py#L106 for the reference.

richardpenman commented 5 days ago

That link 404's. Could you clarify what you mean?

cryptochecktool commented 5 days ago

init.py#L106

class ChromeBased(BrowserCookieLoader): def get_cookies(self): salt = b'saltysalt' length = 16 keys = []

the salt should not be static,need random for anyone.

richardpenman commented 4 days ago

This salt is for decrypting cookies and is the hardcoded value used by chrome: https://gist.github.com/creachadair/937179894a24571ce9860e2475a2d2ec