A friend of mine sent a security report on Isomania, which his AI agent had in turn prepared — twelve points. Nine of them were already closed in the code, one turned out to be a false alarm, and the first was more serious than the report itself rated it.
Why four digits are not protection (the login confirmation code)
The confirmation code from the email had four digits and five attempts. That looks acceptable until the arithmetic is done: a new code costs an attacker one request, and the attempt limit is refreshed along with it. Five sends per quarter of an hour with five attempts each give 2,400 guesses a day against a space of 10,000 combinations. That is roughly a 21 per cent chance of taking a specific account within a day, and under three days in the median.
A CAPTCHA does not help here, because solved challenges sell for about a dollar per thousand. Lockouts do not help either: for a four-digit code to become reliable, a player would have to be locked out after two mistakes, that is punished for a typo.
Six digits and a limit that is not refreshed
The code now has six digits, which means a million combinations instead of ten thousand. Two separate failure limits work underneath it.
The first is counted per email address, summed across all codes inside a time window, so requesting a new code no longer achieves anything. The second is counted per IP address, because a single machine working through many different addresses would never touch the first limit.
Both limits are spent on failures only and are checked before the code is compared, so when a limit is exhausted even the correct code is rejected. This is precision rather than excess: the attacker’s winning attempt is also a correct code.
Additional restrictions
- An origin check on the connection, so an external site cannot open a connection on behalf of a player.
- A message ceiling per connection: 240 per second against a real load of about 80. Some messages are broadcast to every player, so a flood has to cost a plain refusal rather than a parse and a broadcast.
- The camera and microphone are restricted by a permissions policy at the page level, so embedded third-party frames cannot reach them.
The bug the tests did not find
The most telling bug of this story was found neither by the tests nor by code analysis. A six-digit code pasted from the email filled only four fields, because an old truncation to four characters had survived in the code. The test that should have caught it searched the file for the right markers and found them, even though the wrong condition was working right beside them.
The paste logic now lives in a shared module and is verified by running it rather than by reading the source.
A final review of the changes found about ten smaller problems: from the sixth input field not fitting a screen 320 pixels wide, to an error message advising the visitor to request a new code at exactly the moment when a new code could no longer help.
Together with this update the project runs 409 automated checks, and every rule from this article is among them.
