Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: YouTransfer – Self-hosted file sharing

youtransfer.io

Post reply on HN
Print view View original

21–30 of 77 posts

Re: Show HN: YouTransfer – Self-hosted file sharing

#21

Post by dchest »

nsgi wrote: post #13
tokenizerrr wrote: post #10

Earlier quoted context omitted.

Just to reiterate what dchest said, you should never use MD5 anymore, even if you do intent to hash something. MD5 is is broken and should not be used for anything anymore.

What about Gravatar?

Of course, you'll have to use whatever the third-party API uses, which includes Gravatar, but don't use it for anything under your control.

Replace with:

- BLAKE2 if you need a fast cryptographic hash function (e.g. for hashing file contents)

- SHA512 (or SHA256, or SHA-3) if you want a standard cryptographic hash function that is available in your programming language libraries

(Speaking of Gravatar, their use of md5(email) or even more secure hash function won't help protect email addresses against dedicated attackers, as it's easy to iterate over billions of them in seconds, just like in the stories about password cracking you hear, but it works as a simple anti-spam measure.)

Re: Show HN: YouTransfer – Self-hosted file sharing

#22

Post by rbolte »

rbolte wrote: post #18
JupiterMoon wrote: post #15

Earlier quoted context omitted.

Good on you for taking the criticism well. This doesn't seem like a "create an issue on github" problem though. Surely it is a push a patch today problem?

Working on it as we speak! I'm currently running the tests and hope to have a 1.0.2 hotfix ready by lunch. EDIT: The 1.0.2 hotfix is now available with the token generation fix as well as 2 other enhancements.

I've opted for the 16 bits version right now as it fits better in the UI. There will be an additional issue to deal with improving the bitrate as well as making a suitable UI for it.

EDIT: I'm using `crypto.randomBytes(16).toString('hex')` to be precise

Re: Show HN: YouTransfer – Self-hosted file sharing

#23

Post by dchest »

rbolte wrote: post #22
rbolte wrote: post #18

Earlier quoted context omitted.

Working on it as we speak! I'm currently running the tests and hope to have a 1.0.2 hotfix ready by lunch. EDIT: The 1.0.2 hotfix is now available with the token generation fix as well as 2 other enhancements.

I've opted for the 16 bits version right now as it fits better in the UI. There will be an additional issue to deal with improving the bitrate as well as making a suitable UI for it. EDIT: I'm using `crypto.randomBytes(16).toString('hex')` to be precise

I hope you meant 16 bytes :-) If so, it's fine.

Edit: yep, 16 bytes.

Re: Show HN: YouTransfer – Self-hosted file sharing

#26

Post by rbolte »

dchest wrote: post #23
rbolte wrote: post #22

Earlier quoted context omitted.

I've opted for the 16 bits version right now as it fits better in the UI. There will be an additional issue to deal with improving the bitrate as well as making a suitable UI for it. EDIT: I'm using `crypto.randomBytes(16).toString('hex')` to be precise

I hope you meant 16 bytes :-) If so, it's fine. Edit: yep, 16 bytes.

And it's done. The 1.0.2 hotfix is now available with the token generation fix as well as 2 other enhancements.

Re: Show HN: YouTransfer – Self-hosted file sharing

#27

Post by yAnonymous »

rbolte wrote: post #18
JupiterMoon wrote: post #15

Earlier quoted context omitted.

Good on you for taking the criticism well. This doesn't seem like a "create an issue on github" problem though. Surely it is a push a patch today problem?

Working on it as we speak! I'm currently running the tests and hope to have a 1.0.2 hotfix ready by lunch. EDIT: The 1.0.2 hotfix is now available with the token generation fix as well as 2 other enhancements.

Don't worry, it's not critical or anything. JupiterMoon just seems to be a bit of an entitled *ss.

Re: Show HN: YouTransfer – Self-hosted file sharing

#28

Post by dutchbrit »

dchest wrote: post #3

If I read it correctly, this is how a file token is generated, which is supposed to be secure: file.id = md5(file.name + (Math.random() * 1000)); First of all please do not use MD5 for anything anymore, it has known collisions. But you shouldn't also use any hash functions here at all: just generate a long enough random token. Math.random is not a secure PRNG, use crypto.randomBytes in Node or window.crypto.getRandom…

I'd use a uuid
Post reply on HN