Repository navigation
Key backup from Settings works for every login; 4-digit PINs behind a server-side lockout (0.5.0) - #283
Merged
Conversation
…a server-side lockout
- Settings, restore and key reset send the Bearer session (passkey, CoinPay
and phone sessions have no cookie, so backup silently 401'd).
- PINs may be 4-12 digits. GET /api/auth/key-backup no longer returns the
encrypted keys; restore is POST {pin}, checked against the scrypt hash with
5 tries then 15 min, doubling to 24 h. Backups must use the account PIN.
- Changing a verifiable PIN needs the current one; the server backup is
re-encrypted with the new PIN.
- Legacy backups (no verifiable hash) still restore; the client registers the
PIN once it decrypts, upgrading them.
- DELETE /api/auth/key-backup exists now (Complete Key Reset called it).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ThreatCrush Security Scan13 finding(s) MEDIUM: 9 | LOW: 4
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes "can't backup keys from settings page" and allows 4-digit backup PINs, as Anthony asked.
Why backup failed: Settings sent backup/PIN calls with cookies only. Passkey, CoinPay and phone sessions live in localStorage with no cookie, so the server answered 401. The login-time restore (
restoreKeysFromServer) had the same problem.4-digit PINs, safely: before this, any session could GET the encrypted backup and try all 10k PINs offline. Now:
/api/auth/key-backuponly reports existence and timestamps.POST {pin}, checked against the scrypt hash. After 5 wrong PINs restore locks for 15 min; each further lock doubles, up to 24 h (Retry-After). The failure counter is claimed with compare-and-set before hashing, so parallel guesses cannot slip past it.DELETE /api/auth/key-backup, which Complete Key Reset was already calling.Remaining risk: if the database leaks, a 4-digit PIN falls to about 10k scrypt runs. The UI recommends 6+ digits.
Migration
20261006220000_backup_pin_lockout.sqlis already applied on dev2 and PostgREST is reloaded.Tests: 661/661 vitest, including new lockout/race tests and gated-restore route tests;
next buildpasses.Note: messaging/crypto is Preshy's area; Anthony asked for this directly.
🤖 Generated with Claude Code