Can you help?
HashBack is still a work in progress. Can you help us get across the finishing line?
Can you perform a security analysis?
Do you know security and cryptography?
| 🤨 | Was switching from PBKDF2 to a single salted SHA‑256 the right call for this threat model? |
| 🤔 | Is the two‑transaction model cryptographically sufficient, or does ACME’s extra initiation step close an attack vector I haven’t considered? |
| 🤔 | Should receiving services validate the entropy, uniqueness and freshness of the Unus value? |
| 🤔 | Is using a fixed, public salt with SHA‑256 appropriate for this protocol’s goals? |
| ❓ | Are there any attack scenarios where an adversary could trick the server into fetching a malicious verification hash URL? |
| 🧙 | Does the protocol adequately protect against replay attacks if the client publishes the same verification hash twice? |
| 🤔 | Is the verification hash sufficiently bound to the intended destination host? Is the "Host" value in the JSON enough? |
| 🤨 | Is it safe to assume that TLS identity guarantees are symmetric between client and server in all deployment environments? |
| 🤦 | Are there any risks if the either side is behind a reverse proxy or CDN that terminates TLS? |
| ❔ | Is a fixed salt ever a liability? |
| ❔ | Should the salt be versioned or rotated over time? |
| ❓ | Should the JSON claim include an explicit expiration time or maximum validity window? |
| 🤦 | Should the JSON claim include a client identifier beyond the verification URL? |
| ❔ | Should servers rate‑limit or throttle verification‑hash fetches to avoid abuse? Could throttling enable a denial-of-service attack? |
| 🕵️ | Should clients delete verification hashes after successful authentication? |
| 🤔 | Is this protocol simple enough to be formally modelled and would that be worthwhile? |
| ❔ | Are there any weaknesses or issues I haven’t considered? |
If you've found any issues with my draft, please raise an issue on the project's GitHub.
🦔 Hashbert says: “If anything looks suspicious, prod it gently. Preferably with a stick.”
Write a library
I've made a start with a dot-net library that implements the core of the exchange. I plan to extend this into a reusable module you can drop into any dot-net web service. Can you help the project by implementing the exchange into other frameworks?
🦔 Hashbert says: “I dream of a world where every language has a HashBack library and none of them segfault.”
Sponsor me! 💰💲🤑💲💰
Would you like to support ongoing development?
The exact mechanism is still to be discussed — but if you're interested, please let me know.
Another good way to support this project is to employ me! I'm an experienced software engineer with experience in robust designs, distributed systems, cloud systems and resilience when the world reminds you that Failure is Always an Option!™.
🦔 Hashbert says: “If you help HashBack, you help me. And I am adorable.”