{"action":"created","issue":{"url":"https://api.github.com/repos/crystal-lang/crystal/issues/2436","repository_url":"https://api.github.com/repos/crystal-lang/crystal","labels_url":"https://api.github.com/repos/crystal-lang/crystal/issues/2436/labels{/name}","comments_url":"https://api.github.com/repos/crystal-lang/crystal/issues/2436/comments","events_url":"https://api.github.com/repos/crystal-lang/crystal/issues/2436/events","html_url":"https://github.com/crystal-lang/crystal/pull/2436","id":147078287,"number":2436,"title":"Add secure_compare for String to allow for polynomial time comparison.","user":{"login":"skunkworker","id":2637951,"avatar_url":"https://avatars.githubusercontent.com/u/2637951?v=3","gravatar_id":"","url":"https://api.github.com/users/skunkworker","html_url":"https://github.com/skunkworker","followers_url":"https://api.github.com/users/skunkworker/followers","following_url":"https://api.github.com/users/skunkworker/following{/other_user}","gists_url":"https://api.github.com/users/skunkworker/gists{/gist_id}","starred_url":"https://api.github.com/users/skunkworker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/skunkworker/subscriptions","organizations_url":"https://api.github.com/users/skunkworker/orgs","repos_url":"https://api.github.com/users/skunkworker/repos","events_url":"https://api.github.com/users/skunkworker/events{/privacy}","received_events_url":"https://api.github.com/users/skunkworker/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2016-04-09T01:48:34Z","updated_at":"2016-04-10T21:57:39Z","closed_at":"2016-04-10T21:55:58Z","pull_request":{"url":"https://api.github.com/repos/crystal-lang/crystal/pulls/2436","html_url":"https://github.com/crystal-lang/crystal/pull/2436","diff_url":"https://github.com/crystal-lang/crystal/pull/2436.diff","patch_url":"https://github.com/crystal-lang/crystal/pull/2436.patch"},"body":"Securely comparing strings helps to prevent timing attacks. This allows you to compare two strings of equal length in O(n) time. This is helpful in libraries that are comparing two hashes as a result of bcrypt, pbkdf2 etc."},"comment":{"url":"https://api.github.com/repos/crystal-lang/crystal/issues/comments/208081732","html_url":"https://github.com/crystal-lang/crystal/pull/2436#issuecomment-208081732","issue_url":"https://api.github.com/repos/crystal-lang/crystal/issues/2436","id":208081732,"user":{"login":"ysbaddaden","id":47380,"avatar_url":"https://avatars.githubusercontent.com/u/47380?v=3","gravatar_id":"","url":"https://api.github.com/users/ysbaddaden","html_url":"https://github.com/ysbaddaden","followers_url":"https://api.github.com/users/ysbaddaden/followers","following_url":"https://api.github.com/users/ysbaddaden/following{/other_user}","gists_url":"https://api.github.com/users/ysbaddaden/gists{/gist_id}","starred_url":"https://api.github.com/users/ysbaddaden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ysbaddaden/subscriptions","organizations_url":"https://api.github.com/users/ysbaddaden/orgs","repos_url":"https://api.github.com/users/ysbaddaden/repos","events_url":"https://api.github.com/users/ysbaddaden/events{/privacy}","received_events_url":"https://api.github.com/users/ysbaddaden/received_events","type":"User","site_admin":false},"created_at":"2016-04-10T21:57:39Z","updated_at":"2016-04-10T21:57:39Z","body":"It may be a bit hidden thought, and it's lacking documentation. For instance it returns `0` or `1` when one may expect a boolean instead, which will lead to a huge security issue:\r\n\r\n```crystal\r\nif Crypto::Subtle.constant_time_compare(encrypted_password, crypt(password))\r\n  # ERROR: always true!\r\nend\r\n```"}}