Create threat analysis model

vishnuravi / invitable

App Invite Sharing Service

GNU General Public License v3.0

13 stars 2 forks source link

Create threat analysis model #24

Open frankcash opened 9 years ago

frankcash commented 9 years ago

[x] XSS
[x] Password Encryption - Encrypt at db level
[ ] Man in the middle (browser | attacker | server) - require authentication

frankcash commented 9 years ago

I'd like to create an open discussion for security measures we need to take.

@vishnuravi @cris1133 @bltsandwich1 @aarohmankad @misbahkhan

mohnjoosemiller commented 9 years ago

Where in the chain (if we have a plan) are we encrypting the password. In the browser (before it hits the server), or within the server before the database?

misbahkhan commented 9 years ago

@bltsandwich1 I think it should be server sided.

vishnuravi commented 9 years ago

We are currently encrypting with bcrypt on the server side.