Skip to content

Improve documentation for or remove usage of SHA1 in Instance ID #4444

Closed
@robimoltewhp

Description

Hello,

I am using Veracode Tool for code static analysis
https://www.veracode.com
and I am facing one security issue on FirebaseCore component

  • Xcode version: 10.3
  • Firebase SDK version: 6.13.0
  • Firebase Component: Core

The issue says:

File - FIRInstanceIDCheckinService.m: 213

"Description: Standard random number generators do not provide a sufficient amount of entropy when used for security purposes. Attackers can brute force the output of pseudorandom number generators such as rand().
Remediation: If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead. These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL. In Java, use the SecureRandom object to ensure sufficient entropy."

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions