Data and threat analysis

Eidolon stores the following data:

  • Usernames
  • Email addresses
  • Keyed password hashes (HMAC-Keccak) and the respective key
  • Images
  • Upload time of images
  • Image titles
  • Image descriptions
  • Image tags
  • EXIF data of images are preserved
  • Comment texts
  • Time when comment was posted
  • Comment author
  • Album titles
  • Album owner
  • With whom the album is shared

Database exposure

If an attacker were to gain access to the eidolon database they would have access to the above information.

An attacker that gained access to the eidolon database could delete or otherwise corrupt user data, potentially disrupting the service.

Mitigation

Any discovery of a user's real identity can be mitigated by using an anonymous email account.

Passwords are stored salted and hashed in the database rendering them useless to an attacker.
Additionally the authentication mechanism does not need the password to be transmitted in clear text to the server.