Thanks @dom for the clarification! You’re right, it’s not a dictionary attack that a salt is protecting against, at least not in this case. I don’t fully understand the impact of reusing salts as described in the article that you linked, but I agree that it isn’t dictionary attacks, so I’ll update that part of the article 
Ah interesting! I didn’t know about this function. I have no experience using it though. What is the AAD that it references? It is another kind of salt maybe?
Hello ! My toy elixir-hosted elixir-looking language has reached evaluation via AST walking. Nothing too fancy, and I already spotted a lot of design errors, but I find a lot of joy in building this small interpreter from scratch. It also allows me to switch context when I block on something else. The code is quite basic and does not feature any optimizations, so maybe this, or the process, will be interesting to some.
Here is a link : Hosting a small language in elixir, pt 5 - evaluation
The next step for me will be working on the visual editor. Even if the only use of this language is for a side-project private app I’m building for fun, I really want to try to get to a fun visual<->text editing parity.
AAD is “additional authenticated data”, it’s data that’s not part of the encrypted payload, but still gets validated. You have to pass the same value when encrypting and decrypting otherwise the decryption fails. It prevents tampering where an attacker doesn’t modify the encrypted payload itself, but rather copy-pastes it in a different context.
A good AAD here could be the file ID. This way if an attacker swaps the contents of two files A and B in S3, the app will try to decrypt the contents of A with B’s ID as AAD or vice versa, and that will fail even if they were encrypted with the same key.
Kill your Phoenix Context
Phoenix Contexts often become a dumping ground for code that doesn’t have an obvious place. Learn how to organize your code using services, queries, and repositories.
In this blog post, I used Livebook to analyse my house’s consumption and production of electricity. There are some interesting plots powered by mostly sunny days in the last 3 months. Hope you enjoy it!
New Blog Post: Inspecting Elixir Dependencies at Runtime for Security. Doing this is a pretty simple one-liner, but knowing how to do it correctly is extremely important.
New post: How To Add Magic Link Login to phx.gen.auth - The simple, safe, and secure way to extend the tools phx.gen.auth gives you to implement magic link login in your app.
Any and all feedback welcome! Hope you enjoy!
Hey! I’ve just published a post on rendering SVG sparkline charts using Elixir:
https://alexplescan.com/posts/2023/07/08/easy-svg-sparklines/
Very nice description of how you can extends phx.gen.auth to do magic links (without any extra dependencies). Thanks for sharing!
The only minor feedback I’d have is to avoid calling back to your web module from your context module here. This creates a cyclical dependency. The original functions that send emails (like this one), in the Accounts context module avoid this by accepting an extra function that generates a full url, given an encoded token. Extending this pattern would be a better choice IMO.
I released a new project today. Very simple but fun - a webring for the BEAM community.
I’m happy to add anyone here to it if you’re interested!