How long a sign-in takes to fail tells anyone whether the name is an account #138

New Issue

rays · 2026-10-05T10:21:35-07:00

rays commented

2026-10-05 10:21:35 -07:00

Found by the load tests (#133) on 2026-10-05: a wrong password for an account's name was refused a median 31ms later than one for a name that is not an account. login answers the same words either way, as its comment intends, but only checks a password when the name has a hash, so the time alone says which names are accounts here.

rays referenced this issue from a commit

2026-10-05 10:38:31 -07:00

Check passwords a few at a time off the async workers, and check unknown names too (#137, #138)

rays referenced this issue from a commit

2026-10-05 10:38:31 -07:00

Load tests with k6, for what many people at once do to the server (#133)

rays commented

2026-10-05 10:41:18 -07:00

Fixed in f1d3604: a name with no account, or no password, is checked against a fixed decoy hash. The load test's median gap between a known and an unknown name went from 31ms to 0.2ms; in production a made-up name is now refused in 70ms, as long as a real check. Deployed 2026-10-05 (0.10.1-dev).

Fixed in f1d3604: a name with no account, or no password, is checked against a fixed decoy hash. The load test's median gap between a known and an unknown name went from 31ms to 0.2ms; in production a made-up name is now refused in 70ms, as long as a real check. Deployed 2026-10-05 (0.10.1-dev).

rays closed this issue

2026-10-05 10:41:18 -07:00

rays referenced this issue

2026-10-05 10:41:19 -07:00

Load tests: what many people at once do to the server, which the browser tests cannot show #133

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rays/ipx#138