{"action":"created","issue":{"url":"https://api.github.com/repos/gophergala2016/meshbird/issues/6","repository_url":"https://api.github.com/repos/gophergala2016/meshbird","labels_url":"https://api.github.com/repos/gophergala2016/meshbird/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/gophergala2016/meshbird/issues/6/comments","events_url":"https://api.github.com/repos/gophergala2016/meshbird/issues/6/events","html_url":"https://github.com/gophergala2016/meshbird/issues/6","id":130182785,"number":6,"title":"Please use TLS","user":{"login":"codahale","id":207,"avatar_url":"https://avatars.githubusercontent.com/u/207?v=3","gravatar_id":"","url":"https://api.github.com/users/codahale","html_url":"https://github.com/codahale","followers_url":"https://api.github.com/users/codahale/followers","following_url":"https://api.github.com/users/codahale/following{/other_user}","gists_url":"https://api.github.com/users/codahale/gists{/gist_id}","starred_url":"https://api.github.com/users/codahale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/codahale/subscriptions","organizations_url":"https://api.github.com/users/codahale/orgs","repos_url":"https://api.github.com/users/codahale/repos","events_url":"https://api.github.com/users/codahale/events{/privacy}","received_events_url":"https://api.github.com/users/codahale/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-01-31T21:03:29Z","updated_at":"2016-02-02T18:56:56Z","closed_at":null,"body":"I noticed you're using AES-CBC for each packet, which I think is a mistake for a couple of reasons.\r\n\r\nFirst, it's unauthenticated. If an attacker changes the encrypted packets, even if they don't know the key, they can propagate those changes into the plaintext without you knowing.\r\n\r\nSecond, it requires a padding scheme, which opens you up to chosen-ciphertext attacks via padding oracles. It depends on how the application is structured, but this can be catastrophic — an attacker can potentially decrypt data, even without the key.\r\n\r\nThird, it doesn't protect against replay attacks. An attacker can re-send a particular packet, and you will have no way of knowing that happened.\r\n\r\nI strongly recommend you use TLS. Go has wonderful support for it in the standard library with secure default configurations. If you want to avoid managing your own CA chain, you could use a whitelist of certificate fingerprints as a shared configuration to prevent unauthorized access."},"comment":{"url":"https://api.github.com/repos/gophergala2016/meshbird/issues/comments/178757856","html_url":"https://github.com/gophergala2016/meshbird/issues/6#issuecomment-178757856","issue_url":"https://api.github.com/repos/gophergala2016/meshbird/issues/6","id":178757856,"user":{"login":"miolini","id":434756,"avatar_url":"https://avatars.githubusercontent.com/u/434756?v=3","gravatar_id":"","url":"https://api.github.com/users/miolini","html_url":"https://github.com/miolini","followers_url":"https://api.github.com/users/miolini/followers","following_url":"https://api.github.com/users/miolini/following{/other_user}","gists_url":"https://api.github.com/users/miolini/gists{/gist_id}","starred_url":"https://api.github.com/users/miolini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miolini/subscriptions","organizations_url":"https://api.github.com/users/miolini/orgs","repos_url":"https://api.github.com/users/miolini/repos","events_url":"https://api.github.com/users/miolini/events{/privacy}","received_events_url":"https://api.github.com/users/miolini/received_events","type":"User","site_admin":false},"created_at":"2016-02-02T18:56:56Z","updated_at":"2016-02-02T18:56:56Z","body":"We have created related ticket 6 days ago\r\nhttps://github.com/meshbird/meshbird/issues/4"}}