eidolon/templates/threat.hamlet

40 lines
1.2 KiB
Text
Raw Normal View History

2016-09-07 15:22:58 +00:00
$newline always
<div .medium>
<h1>
Data and threat analysis
<h2>
Eidolon stores the following data:
<ul>
<li>Usernames
<li>Email addresses
2016-12-03 16:16:22 +00:00
<li>Keyed password hashes (HMAC-Keccak) and the respective key
2016-09-07 15:22:58 +00:00
<li>Images
<li>Upload time of images
<li>Image titles
<li>Image descriptions
<li>Image tags
<li>EXIF data of images are preserved
<li>Comment texts
<li>Time when comment was posted
<li>Comment author
<li>Album titles
<li>Album owner
<li>With whom the album is shared
<h2>
Database exposure
<p>
If an attacker were to gain access to the eidolon database they would have
access to the above information.
<p>
An attacker that gained access to the eidolon database could delete or
otherwise corrupt user data, potentially disrupting the service.
<h3>
Mitigation
<p>
Any discovery of a user's real identity can be mitigated by using an
anonymous email account.
<p>
Passwords are stored salted and hashed in the database rendering them
2016-09-09 19:38:11 +00:00
useless to an attacker.<br>Additionally the authentication mechanism does not
2016-09-07 15:22:58 +00:00
need the password to be transmitted in clear text to the server.