![Oracle Drags Its Feet in the JavaScript Trademark Dispute](https://cdn.sanity.io/images/cgdhsj6q/production/919c3b22c24f93884c548d60cbb338e819ff2435-1024x1024.webp?w=400&fit=max&auto=format)
Security News
Oracle Drags Its Feet in the JavaScript Trademark Dispute
Oracle seeks to dismiss fraud claims in the JavaScript trademark dispute, delaying the case and avoiding questions about its right to the name.
The tsscmp npm package is a utility for performing timing-safe string comparisons. This is particularly useful for security purposes, such as comparing cryptographic hashes or passwords, to prevent timing attacks.
Timing-Safe String Comparison
This feature allows you to compare two strings in a way that is resistant to timing attacks. The comparison takes the same amount of time regardless of how similar the strings are, which helps to prevent attackers from gaining information based on the time it takes to compare the strings.
const tsscmp = require('tsscmp');
const a = 'password123';
const b = 'password123';
if (tsscmp(a, b)) {
console.log('Strings are equal');
} else {
console.log('Strings are not equal');
}
The safe-compare package provides a similar functionality to tsscmp by performing timing-safe string comparisons. It ensures that the comparison takes a constant amount of time, regardless of the input strings, thereby preventing timing attacks. Compared to tsscmp, safe-compare offers a similar API and is also focused on security.
The secure-compare package is another alternative for timing-safe string comparisons. It is designed to be simple and efficient, ensuring that the comparison time is constant to mitigate timing attacks. Like tsscmp, secure-compare is used to securely compare sensitive strings such as passwords or tokens.
Prevents timing attacks using Brad Hill's Double HMAC pattern to perform secure string comparison. Double HMAC avoids the timing atacks by blinding the timing channel using random time per attempt comparison against iterative brute force attacks.
npm install tsscmp
To compare secret values like authentication tokens, passwords or capability urls so that timing information is not leaked to the attacker.
var timingSafeCompare = require('tsscmp');
var sessionToken = '127e6fbfe24a750e72930c';
var givenToken = '127e6fbfe24a750e72930c';
if (timingSafeCompare(sessionToken, givenToken)) {
console.log('good token');
} else {
console.log('bad token');
}
##License: MIT
Credits to: @jsha | @bnoordhuis | @suryagh |
FAQs
Timing safe string compare using double HMAC
The npm package tsscmp receives a total of 0 weekly downloads. As such, tsscmp popularity was classified as not popular.
We found that tsscmp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Oracle seeks to dismiss fraud claims in the JavaScript trademark dispute, delaying the case and avoiding questions about its right to the name.
Security News
The Linux Foundation is warning open source developers that compliance with global sanctions is mandatory, highlighting legal risks and restrictions on contributions.
Security News
Maven Central now validates Sigstore signatures, making it easier for developers to verify the provenance of Java packages.