UniversalDevicesInc/polyglot-v2

The "encryption" class does nothing of value

Closed this issue · 1 comments

const encoding = ',2YE6=#r(z5?Y4=a';

The variable called "encoding" is actually the password used to derive the cryptographic key, which is both static across all installations and published on GitHub. This means it provides no value; all someone viewing the ciphertext needs to do is lookup this project and extract the key.

Incidentally using AES without an initialization vector appears to have been deprecated by node, but I wouldn't bother fixing that unless some form of localized key generation can be established.

I don't know what the purpose of this encryption was, but it's not fulfilling it.

Correct, this is on the todo list. Encryption is currently not implemented.