-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Labels
Description
Currently, there are two big security issues with the color commands.
- All the color commands sent at once, this allows for an adversary to get lucky by having the first shader already pre-computed(actually very trivial since there aren't that many possible first colors) and then having enough time to compute the rest of the colors. Instead, we should send the colors in spaced intervals so that the next color is not known until it would be too late to fake.
- We don't enforce that the client sends a response back quickly. This allows for an adversary to receive a color command, compute, and then send back the response. The server should verify that the time is not much more than RTT to avoid foul play.
Reactions are currently unavailable