Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Impostor security #27

Open
ghost opened this issue Dec 10, 2017 · 1 comment
Open

Impostor security #27

ghost opened this issue Dec 10, 2017 · 1 comment

Comments

@ghost
Copy link

ghost commented Dec 10, 2017

Sending data without some system of verifying the sender can be reverse engineered and may allow hackers to send data as someone else. Take this example:

  1. The hacker receives a message with the sender's identifier (userCode)
  2. The hacker sends a message changing his sender's identifier to the previously received one.
  3. Sent message appears to be from the original sender instead of hacker
@ghost ghost closed this as completed Dec 10, 2017
@ghost ghost reopened this Dec 10, 2017
@blurpy
Copy link
Owner

blurpy commented Dec 11, 2017

You are right that there is no proper support for securing messages. This issue would probably be solved with encryption, as suggested in issue #5.

Doing as you suggest may look suspicious though, as the user being hijacked would appear to change ip address back and forth.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant