PBKDF2 iterations reduced 10x - weakens anonymity against brute-force attacks

Open Beginner friendly
#61 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
next.js, supabase, typescript
Domain
authentication, security

Research direction

Start with lib/anonymization.ts:35 and lib/supabase-auth.ts:72, tracing how each PBKDF2 hash is generated and verified. Confirm the intended iteration counts in both paths and inspect any existing authentication or anonymization checks; done means both reduced counts are restored without changing the surrounding identity or verification flow.

Written by the indexing model from the issue text.

Description

bug help wanted

Issue

The anonymization system intentionally reduced PBKDF2 iterations for "speed":

  • generateAnonymousIdentity in lib/anonymization.ts:35: reduced from 100,000 to 10,000 iterations
  • Double hashing in lib/supabase-auth.ts:72: reduced from 50,000 to 5,000 iterations

Why this matters

The anonymization system's security model depends on the PBKDF2 hash being computationally infeasible to brute-force. If an attacker obtains the database (which contains verification_hash and salt), they can attempt to reverse the hash by trying common email patterns:

  • student@iitbh.ac.in
  • professor@iitbh.ac.in
  • Common name patterns at IIT Bhilai

At 10,000 iterations, this is 10x faster to brute-force than the originally intended 100,000. Combined with the small email space (all IIT Bhilai students), a targeted attack could deanonymize users.

Fix

  1. Restore 100,000 iterations for generateAnonymousIdentity
  2. Restore 50,000 iterations for the double-hash verification
  3. If speed is a concern, consider client-server split: do the slow hash server-side only
Dominant language
TypeScript
Stars
0
Forks
26
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenLake/RateMyCourse

All issues in OpenLake/RateMyCourse

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.