Data and threat analysis
Eidolon stores the following data:
- Email addresses
- Keyed password hashes (HMAC-Keccak) and the respective key
- Upload time of images
- Image titles
- Image descriptions
- Image tags
- EXIF data of images are preserved
- Comment texts
- Time when comment was posted
- Comment author
- Album titles
- Album owner
- With whom the album is shared
If an attacker were to gain access to the eidolon database they would have access to the above information.
An attacker that gained access to the eidolon database could delete or otherwise corrupt user data, potentially disrupting the service.
Any discovery of a user's real identity can be mitigated by using an anonymous email account.
Passwords are stored salted and hashed in the database rendering them
useless to an attacker.
Additionally the authentication mechanism does not need the password to be transmitted in clear text to the server.