adamniedzielski/tiddle

Remove unnecessary secure compare

Closed this issue ยท 0 comments

Thanks @DamirSvrtan for explaining this to me! ๐Ÿ’š

Here we load all the tokens for the given user into the memory and perform secure compare on them.

Secure compare was necessary to prevent timing attacks when we were storing tokens in the database. However, since version 0.5.0 we are storing only token digests which has a side effect of preventing timing attacks.

We can:

  1. replace the code with a single SQL query
  2. suggest adding an index on body column in the README