Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: smallbets/userbase
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: master
Choose a base ref
...
head repository: smallbets/userbase
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: security-review-updated
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 17 commits
  • 29 files changed
  • 2 contributors

Commits on Nov 21, 2019

  1. Re-implemented database sharing

    @j-berman
    j-berman committed Nov 21, 2019
    Configuration menu
    Copy the full SHA
    fe67d4b View commit details
    Browse the repository at this point in the history

  2. UserCannotBeYou error returned by server functioning properly

    @j-berman
    j-berman committed Nov 21, 2019
    Configuration menu
    Copy the full SHA
    54ef493 View commit details
    Browse the repository at this point in the history

  3. signUp(), signIn(), & init() all return user's public key 

    - enables app to display it so user can verify sharing database with correct person
    @j-berman
    j-berman committed Nov 21, 2019
    Configuration menu
    Copy the full SHA
    b1731ec View commit details
    Browse the repository at this point in the history

  4. Re-implemented findDatabases() 

    - makes it easy to see all databases shared with user
    @j-berman
    j-berman committed Nov 21, 2019
    Configuration menu
    Copy the full SHA
    2229def View commit details
    Browse the repository at this point in the history

  5. Merge branch 'master' into security-review

    @j-berman
    j-berman committed Nov 21, 2019
    Configuration menu
    Copy the full SHA
    9edac31 View commit details
    Browse the repository at this point in the history

Commits on Nov 22, 2019

  1. Basic database sharing working in ugliest todo app

    @j-berman
    j-berman committed Nov 22, 2019
    Configuration menu
    Copy the full SHA
    c260a9e View commit details
    Browse the repository at this point in the history

  2. Back Up Key option provided in ugliest to-do app

    @j-berman
    j-berman committed Nov 22, 2019
    Configuration menu
    Copy the full SHA
    2c062ba View commit details
    Browse the repository at this point in the history

  3. Implemented forgotPassword in ugliest to-do app

    @j-berman
    j-berman committed Nov 22, 2019
    Configuration menu
    Copy the full SHA
    f18c693 View commit details
    Browse the repository at this point in the history

  4. updateUser form working in ugliest to-do app

    @j-berman
    j-berman committed Nov 22, 2019
    Configuration menu
    Copy the full SHA
    e1eedc0 View commit details
    Browse the repository at this point in the history

Commits on Nov 25, 2019

  1. Swapped PBKDF2 for Scrypt & separated pw token & encryption key w/HKDF 

    - User inputs password
-> Client hashes password with Scrypt
-> Client derives 2 keys from password hash with HKDF: password token + password-based encryption key
-> Client sends server password token for storage + future auth. See https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ for similar approach

- Salts are randomly generated at every step and are all sent to the server for storage on sign up
- On sign in, client requests user's password salts via an unauthenticated endpoint in order to rebuild password token
    @j-berman
    j-berman committed Nov 25, 2019
    Configuration menu
    Copy the full SHA
    64560e4 View commit details
    Browse the repository at this point in the history

  2. SHA-256 password token on server before storing 

    - prevents someone with access to data stored on server from obtaining valid session ID's via the app
- Note that the original password goes through Scrypt and then HKDF client-side to get the password token, which is then sent to server
    @j-berman
    j-berman committed Nov 25, 2019
    Configuration menu
    Copy the full SHA
    c3d4b19 View commit details
    Browse the repository at this point in the history

  3. Merge pull request #18 from encrypted-dev/secure-pw 

    Secure password-based cryptography
    @dvassallo
    dvassallo authored Nov 25, 2019
    Configuration menu
    Copy the full SHA
    b9af4d7 View commit details
    Browse the repository at this point in the history

Commits on Nov 26, 2019

  1. Make the sdk point to beta and minor style updates in the ugly todo app

    @dvassallo
    dvassallo committed Nov 26, 2019
    Configuration menu
    Copy the full SHA
    030f79e View commit details
    Browse the repository at this point in the history

Commits on Dec 2, 2019

  1. Add missing babel-polyfill depdendency

    @dvassallo
    dvassallo committed Dec 2, 2019
    Configuration menu
    Copy the full SHA
    1af6e5c View commit details
    Browse the repository at this point in the history

Commits on Jan 7, 2020

  1. Merge branch 'master' into security-review

    @j-berman
    j-berman committed Jan 7, 2020
    Configuration menu
    Copy the full SHA
    f689786 View commit details
    Browse the repository at this point in the history

  2. Fix merge issues

    @j-berman
    j-berman committed Jan 7, 2020
    Configuration menu
    Copy the full SHA
    c36650b View commit details
    Browse the repository at this point in the history

  3. Delete pbkdf implementation that slipped through the merge

    @j-berman
    j-berman committed Jan 7, 2020
    Configuration menu
    Copy the full SHA
    1c04843 View commit details
    Browse the repository at this point in the history
Loading