Github's securing webhooks page says:
Using a plain
==operator is not advised. A method likesecure_compareperforms a “constant time” string comparison, which renders it safe from certain timing attacks against regular equality operators.
I use bcrypt.compare('string', 'computed hash') when comparing passwords.
What makes this a "secure compare" and can I do this using the standard crypto library in Node?
Aucun commentaire:
Enregistrer un commentaire