search

thaliproject / Thali_CordovaPlugin

Thali p2p plugin
MIT License
226 stars 44 forks source link

SECURITY - Fixes need to identity exchange #133

Open yaronyg opened 8 years ago

yaronyg commented 8 years ago

We need to re-home it on TLS - This will mean getting rid of wrongPeer errors all together and just using TLS to validate identity.

Request Delay - In order to slow down attacks we need to make sure the smallHashStateMachine will only make cb and rnmine requests at the rate of 1 per second.

Response Delay - In order to slow down certain attacks the largeHashStateMachine needs to only accept cb and rnmine requests at the rate of 1 per second. Also note that the current request handling code is purely synchronous so we don't have to worry about handling multiple requests simultaneously, the delay feature will change that. So be aware.

yaronyg commented 8 years ago

identityexchange.js - Need to remove reference to ThaliEmitter