~steering/inspircd++.git/src/modules/m_spanningtree/hmac.cpp, branch v3.17.1 Unnamed repository; edit this file 'description' to name the repository. https://www.cgit.space/~steering/inspircd++.git/atom/src/modules/m_spanningtree/hmac.cpp?h=v3.17.1 2024-06-07T09:30:30Z Update copyright headers. 2024-06-07T09:30:30Z InspIRCd Robot 2024-06-07T09:30:30Z urn:sha1:855c1f6ab4927e219220ac2a9a14f0d896c18c6f Use TimingSafeCompare when comparing server SSL fingerprints. 2024-02-11T04:10:41Z Sadie Powell 2024-02-11T04:10:41Z urn:sha1:9dba51c12a78ccce865f3a573b9d6435a576f13e Update copyright headers. 2022-12-30T11:31:28Z InspIRCd Robot 2022-12-30T11:31:28Z urn:sha1:2b810b412aeee2d9c79d97fa54a80e317981a6d8 Update copyright headers. 2020-01-11T22:14:43Z InspIRCd Robot 2020-01-11T22:02:47Z urn:sha1:aa692dc1039b63deef7886e914ec499abe7facaf Say "SSL certificate fingerprint" instead of "SSL fingerprint" everywhere 2014-07-19T12:39:04Z Attila Molnar 2014-07-19T12:39:04Z urn:sha1:3d0fa60ba524ce1af8056f86a126aa506f97261b Use TimingSafeCompare() to compare passwords and password hashes (non-hmac only) 2014-06-28T16:27:51Z Attila Molnar 2014-06-28T16:27:51Z urn:sha1:c1cc5cf147babcd834ba0dbbdd4b1c1d4ae010b6 Issue #882 m_spanningtree Send the cert fingerprint message to opers only after successful auth 2014-06-28T16:15:59Z Attila Molnar 2014-06-28T16:15:59Z urn:sha1:0c9a94ea9285d1094c031d0c4ed06326b99cf890 Check fingerprint before checking password (server linking) 2014-06-28T16:15:12Z Matthew Martin 2014-06-26T17:36:51Z urn:sha1:2cffabe0c7375a15c702aeaea5d553d90a549860 Checking the password before the fingerprint means that even without the correct cert it's possible to brute force the password or leak information about it. Checking the fingerprint means attackers must forge the cert before they can learn any information about the password. m_spanningtree Don't rely on "m_sha256.so" being loaded, use any "hash/sha256" service provider 2014-04-08T14:48:10Z Attila Molnar 2014-04-08T14:48:10Z urn:sha1:a5986ac2d317d148074522007007a6aac85baadb m_spanningtree Remove the (now) undocumented disablehmac config option 2014-04-08T14:41:09Z Attila Molnar 2014-04-08T14:41:09Z urn:sha1:f7eabed15819e7a3316b0ab2dc8a28f59f25ce2c