Show HN: YouTransfer – Self-hosted file sharing

Post by notjk » Mon, Oct 05, 2015, 9:03 AM UTC

Post by nsgi » Mon, Oct 05, 2015, 9:06 AM UTC

tokenizerrr wrote: post #10

rbolte wrote: post #4

Earlier quoted context omitted.

Thanks for scrutinising the codebase! You are absolutely right that there is no need for creating a hash. This was just plain laziness on my part. I've created an issue ( https://github.com/remie/YouTransfer/issues/101 ) to change the token generation.

Just to reiterate what dchest said, you should never use MD5 anymore, even if you do intent to hash something. MD5 is is broken and should not be used for anything anymore.

Post by JupiterMoon » Mon, Oct 05, 2015, 9:14 AM UTC

rbolte wrote: post #4

dchest wrote: post #3

If I read it correctly, this is how a file token is generated, which is supposed to be secure: file.id = md5(file.name + (Math.random() * 1000)); First of all please do not use MD5 for anything anymore, it has known collisions. But you shouldn't also use any hash functions here at all: just generate a long enough random token. Math.random is not a secure PRNG, use crypto.randomBytes in Node or window.crypto.getRandom…

Thanks for scrutinising the codebase! You are absolutely right that there is no need for creating a hash. This was just plain laziness on my part. I've created an issue ( https://github.com/remie/YouTransfer/issues/101 ) to change the token generation.

Post by rbolte » Mon, Oct 05, 2015, 9:21 AM UTC

stevekemp wrote: post #16

These kind of projects are a lot of fun. I wrote a simple one, in Ruby, using Sinatra here: https://github.com/skx/web-file-publisher But then as an experiment I wrote another which uses TOTP to authenticate uploads, so you can upload a file directly via CURL with a suitable TOTP device. This is written in golang: https://github.com/skx/go-experiments/tree/master/publishr Using TOTP limits compromise if your upload i…

Post by dchest » Mon, Oct 05, 2015, 9:31 AM UTC

rbolte wrote: post #18

JupiterMoon wrote: post #15

Earlier quoted context omitted.

Good on you for taking the criticism well. This doesn't seem like a "create an issue on github" problem though. Surely it is a push a patch today problem?

Working on it as we speak! I'm currently running the tests and hope to have a 1.0.2 hotfix ready by lunch. EDIT: The 1.0.2 hotfix is now available with the token generation fix as well as 2 other enhancements.