Skip to content

All user input encryption ends with "="! #8

@spencerthayer

Description

@spencerthayer

I think I just discovered a significant vulnerability with TorchNoteJS. All user entries end with a =.

This doesn't suggest that communications are not securely encrypted but rather this makes bot obfuscation irrelevant as a sophisticated attacker could ignore any line that doesn't end with a =.

Proposed solutions:

  • Add a = to the end of generated bot obfuscations.
  • Determine why ever user input ends with =.

Metadata

Metadata

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions