eidolon/templates/threat.hamlet

40 lines
1.2 KiB
Plaintext

$newline always
<div .medium>
<h1>
Data and threat analysis
<h2>
Eidolon stores the following data:
<ul>
<li>Usernames
<li>Email addresses
<li>Salted password hashes (SHA1) and the respective salt
<li>Images
<li>Upload time of images
<li>Image titles
<li>Image descriptions
<li>Image tags
<li>EXIF data of images are preserved
<li>Comment texts
<li>Time when comment was posted
<li>Comment author
<li>Album titles
<li>Album owner
<li>With whom the album is shared
<h2>
Database exposure
<p>
If an attacker were to gain access to the eidolon database they would have
access to the above information.
<p>
An attacker that gained access to the eidolon database could delete or
otherwise corrupt user data, potentially disrupting the service.
<h3>
Mitigation
<p>
Any discovery of a user's real identity can be mitigated by using an
anonymous email account.
<p>
Passwords are stored salted and hashed in the database rendering them
useless to an attacker.<br>Additionally the authentication mechanism does not
need the password to be transmitted in clear text to the server.