Opened 5 years ago

Closed 5 years ago

#11215 closed defect (fixed)

Add timestamp/expiry to HMAC verification code in BridgeDB's local CAPTCHAs

Reported by: isis Owned by: isis
Priority: High Milestone:
Component: Circumvention/BridgeDB Version:
Severity: Keywords: bridgedb-https, security, bridgedb-0.2.1, easy
Cc: isis, sysrqb Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

The CAPTCHAs created in #10809 are in the form:

HMACFn := HMAC(HMAC_KEY, REQUEST_IP_ADDR)
CAPTCHA_VERIFICATION := HMACFn(RSA_ENC(CAPTCHA_ANSWER))


When they really should be more like:

HMACFn := HMAC(HMAC_KEY, REQUEST_IP_ADDR)
CAPTCHA_VERIFICATION := HMACFn(TIMESTAMP, RSA_ENC(CAPTCHA_ANSWER))


See this commit message from the original branch. After adding the timestamp to the CAPTCHA_VERIFICATION creation in bridgedb.captcha.GimpCaptcha.createChallenge(), said timestamp should obviously be checked that it is not expired (according to some easily configurable expiration period) in bridgedb.captcha.GimpCaptcha.checkSolution().

Child Tickets

Change History (2)

comment:1 Changed 5 years ago by isis

Keywords: bridgedb-0.2.1 added; bridgedb-0.1.6 removed
Status: newneeds_review

Fixed in my fix/11215-captcha-timeouts branch.

The default is to timeout 30 minutes after the client has been given the CAPTCHA.

comment:2 Changed 5 years ago by isis

Resolution: fixed
Status: needs_reviewclosed

Merged to bridgedb-0.2.1.

Note: See TracTickets for help on using tickets.