dchest

commit bf860211ecd40d91d1ae5b4f2483bf7744bf2924
Author: Dmitry Chestnykh <dmitry@codingrobots.com>
Date:   Wed Apr 27 17:22:20 2016 +0200

    Add intermediate "Analyzing" page before showing results

commit dca02dd308695f8762d6d8ba718c1bf2a715e893
Author: Dmitry Chestnykh <dmitry@codingrobots.com>
Date:   Wed Apr 27 16:10:41 2016 +0200

dchest

Securing Go web applications

There are lots of security-related things to keep in mind when writing a web application, as the Web is a place full of danger: cross-site scripting (XSS), cross-site request forgery (CSRF), clickjacking, brute forcing, spam and so on.

Go gets many things right by default: for example, templates from the standard library make it hard to accidentally introduce XSS vulnerabilities. But what about other attacks? Fortunately, there are a few open source Go packages

dchest

yescrypt pre- and post-hashing
http://thread.gmane.org/gmane.comp.security.phc/1271/focus=2370

Example of 3rd attack described there:

User has a passpharse P. In one protocol, to derive key from
this passphrase, BLAKE2s is used. The hashed passphrase
is then sent to some server.

  P — user's passphrase

dchest

// Copyright (C) 2016 Dmitry Chestnykh
// MIT License. See LICENSE file for details.

import { randomBytes } from "../random";
import { assert } from "../../utils/assert";
import { wipe } from "../../utils/wipe";

// TODO(dchest): some functions ara copies of ../sign/ed25519.
// Find a way to combine them without opening up to public.

dchest

// Studying XorShift128+ pseudorandom number generator
package main

import (
	"fmt"
	"strconv"
)

var state0, state1 uint64

dchest

// Simple XOR error correction demo.
"use strict";

const packets = [
  "hello world",
  "JavaScript!",
  "lose me plz",
  "another one"
].map((s) => new Buffer(s));

dchest

// randomString(length)
// --------------------
// 
// Generates and returns a cryptographically secure
// uniform alphanumeric random string.
//
// Examples:
//
//  randomString(14) // "oXYWpc1vODNR3M"
//  randomString.hex(8) // "663c722b65943b9b"

dchest

var os = require('os');
var crypto = require('crypto');

var machineId = crypto.createHash('md5').update(os.hostname()).digest().slice(0, 3);
var objectIdCounter = crypto.randomBytes(4).readUInt32BE() & 0xffffff;

// Returns a unique objectId as a hex string.
function newObjectId() {
  var buf = new Buffer(12);
  // Current time, 4 bytes.

dchest

package main

import (
	"encoding/hex"
	"fmt"

	"golang.org/x/crypto/curve25519"
)

func main() {

dchest

#include <assert.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

enum type {
    NIL,