{"action":"created","issue":{"url":"https://api.github.com/repos/pillarjs/csrf/issues/10","repository_url":"https://api.github.com/repos/pillarjs/csrf","labels_url":"https://api.github.com/repos/pillarjs/csrf/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/pillarjs/csrf/issues/10/comments","events_url":"https://api.github.com/repos/pillarjs/csrf/issues/10/events","html_url":"https://github.com/pillarjs/csrf/pull/10","id":154382822,"number":10,"title":"Timing attack vulnerability - upgrade scmp to tsscmp","user":{"login":"suryagh","id":5177920,"avatar_url":"https://avatars.githubusercontent.com/u/5177920?v=3","gravatar_id":"","url":"https://api.github.com/users/suryagh","html_url":"https://github.com/suryagh","followers_url":"https://api.github.com/users/suryagh/followers","following_url":"https://api.github.com/users/suryagh/following{/other_user}","gists_url":"https://api.github.com/users/suryagh/gists{/gist_id}","starred_url":"https://api.github.com/users/suryagh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/suryagh/subscriptions","organizations_url":"https://api.github.com/users/suryagh/orgs","repos_url":"https://api.github.com/users/suryagh/repos","events_url":"https://api.github.com/users/suryagh/events{/privacy}","received_events_url":"https://api.github.com/users/suryagh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-12T02:20:05Z","updated_at":"2016-05-12T02:37:34Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/pillarjs/csrf/pulls/10","html_url":"https://github.com/pillarjs/csrf/pull/10","diff_url":"https://github.com/pillarjs/csrf/pull/10.diff","patch_url":"https://github.com/pillarjs/csrf/pull/10.patch"},"body":"Constant-time string-comparison approach used by [scmp](https://www.npmjs.com/package/scmp) is still vulnerable to [timing attacks](https://codahale.com/a-lesson-in-timing-attacks/) on node.  [Here](https://github.com/nodejs/node-v0.x-archive/issues/8560#issuecomment-59793384) is relative recent discussion by node core team. The recommendation is to use [double HMAC comparison](https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double). \r\n\r\nAs a fix upgrade to [tsscmp](https://www.npmjs.com/package/tsscmp) that uses the recommended approach implemented in the [latest version of node](https://github.com/nodejs/node/pull/3073)"},"comment":{"url":"https://api.github.com/repos/pillarjs/csrf/issues/comments/218644782","html_url":"https://github.com/pillarjs/csrf/pull/10#issuecomment-218644782","issue_url":"https://api.github.com/repos/pillarjs/csrf/issues/10","id":218644782,"user":{"login":"dougwilson","id":67512,"avatar_url":"https://avatars.githubusercontent.com/u/67512?v=3","gravatar_id":"","url":"https://api.github.com/users/dougwilson","html_url":"https://github.com/dougwilson","followers_url":"https://api.github.com/users/dougwilson/followers","following_url":"https://api.github.com/users/dougwilson/following{/other_user}","gists_url":"https://api.github.com/users/dougwilson/gists{/gist_id}","starred_url":"https://api.github.com/users/dougwilson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dougwilson/subscriptions","organizations_url":"https://api.github.com/users/dougwilson/orgs","repos_url":"https://api.github.com/users/dougwilson/repos","events_url":"https://api.github.com/users/dougwilson/events{/privacy}","received_events_url":"https://api.github.com/users/dougwilson/received_events","type":"User","site_admin":false},"created_at":"2016-05-12T02:37:34Z","updated_at":"2016-05-12T02:37:34Z","body":"Thanks! This is good to know. Before we up and switch dependencies, is there a reason why the `scmp` dependency itself cannot be fixed? Was there an issue filed to the author of this module that was closed? For example, if `scmp` is fixed, modules like us would simply upgrade and everytone would be happier, rather than trying to swap modules for some reason. Do these modules have different purposes?\r\n\r\nWe can certainly switch modules, but I want to make sure all the bases are covered."}}