Comments (8)
Use the threat model docu wiki page if something has been found and discussed in this issue.
from qabel-core.
IMO it is necessary to discuss whether we treat all drop messages as vulnerable to timing attacks or none.
Will a future module developer be able to implement an "auto-response" function? If so we need to care about the crypto functions which are used to handle the decryption/verification of such a message.
In addition to this we need to evaluate how exceptions for these functions are handled because they give a timing attack vector [1].
[1] http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/MeyerChristopher/diss.pdf
from qabel-core.
This is a rather old issue. What is the status of this @L-Henke and @roeslpa? If need be and reasonable use re-label, attach a milestone or assignee. Anyway an update in here would be nice.
from qabel-core.
This is a META issue to gather vulnerable components.
from qabel-core.
IMO this issue can be closed since this secure coding wiki exists, until now we cared about it and from now on everyone who writes critical code should read the wiki.
Any other thoughts about this? @L-Henke
from qabel-core.
I will create a PR which incorporates the wiki page into our contribution guidelines and then close this issue.
from qabel-core.
@thechauffeur are you okay with it if write it to the guidelines?
from qabel-core.
Automatically resolved by #424
from qabel-core.
Related Issues (20)
- Emojis in nick name or alias break the avatar
- FSCK for box volumes HOT 5
- define color space for contacts HOT 2
- Pin TLS certificate CA
- configurable test servers HOT 1
- Cross-client sync for contacts
- Cross-client sync for chat history
- qabel-cli
- qabel-cli project base
- qabel-cli box upload/download
- qabel-cli chat send and dump
- qabel-cli box ls
- Web Access
- cross client sync of drop messages HOT 1
- cross-client sync of contacts HOT 1
- qabel-cli noisebox encrypt|decrypt HOT 1
- Master is broken on GOCD-CI server HOT 1
- Cache downloaded metadata
- Transactions for Repositories HOT 2
- Mocking framework HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from qabel-core.