Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[FEATURE REQUEST] Prevent timing attacks to detect valid emails #1026

Open
janwever opened this issue Nov 5, 2024 · 5 comments
Open

[FEATURE REQUEST] Prevent timing attacks to detect valid emails #1026

janwever opened this issue Nov 5, 2024 · 5 comments
Labels
enhancement New feature or request

Comments

@janwever
Copy link

janwever commented Nov 5, 2024 •
edited
Loading

Motivation
My motivation is to make the software more secure,

Describe the solution you'd like
When you are requesting a password reset and you press the button you will get a loading state because the server will need to send an email to the user with a link to change the password. But the loading state is really short when you request a password reset for a username that does not exist, while when you do it for a username that does exist it takes a long time.

So, this wil indicate for potential hackers that a username/email exists or not on the LDAP database. It would be more secure if you put this in a background task/job in async or something. So you will always show "password reset send" immediatly and fire the job that checks for user and sends email in the background.

Describe alternatives you've considered
X

Additional context
X
@janwever janwever added the enhancement New feature or request label Nov 5, 2024
@nitnelave nitnelave changed the title [FEATURE REQUEST] [FEATURE REQUEST] Prevent timing attacks to detect valid emails Nov 5, 2024
@nitnelave
Copy link
Member

Are you using stable or latest? Latest has a 3 second pause before responding, which should be enough (unless the attacker starts using precise timing and statistics based attacks, but that seems unlikely).
When considering the security of password resets, you might also worry about the potential for spamming. It seems reasonable to set a rate limiter like fail2ban in front of the endpoint anyway.

@eyJhb
Copy link

eyJhb commented Nov 7, 2024

Couldn't it just spawn a thread in the background that does the email sending, so that you can't really do timing attacks? I static 3s delay will not stop much.

@janwever
Copy link
Author

i am not sure on which version i am, i just installed from the apt-get repo so i think its stable

Are you using stable or latest? Latest has a 3 second pause before responding, which should be enough (unless the attacker starts using precise timing and statistics based attacks, but that seems unlikely). When considering the security of password resets, you might also worry about the potential for spamming. It seems reasonable to set a rate limiter like fail2ban in front of the endpoint anyway.

@nitnelave
Copy link
Member

There was a new release yesterday, so as soon as it makes its way to the repository, you'll have a newer version to play with which definitely will include the 3s delay.

Would that solve your problem?

@Masgalor
Copy link
Contributor

@janwever the package repository now contains the recent release 0.6.0 you may update and use lldap -V to make sure you are running the latest version.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@nitnelave @eyJhb @Masgalor @janwever