Security

How access is protected

A short, honest account of the controls that exist — and the ones that do not yet.

Sign-in

• Email and password. Passwords are stored as PBKDF2-HMAC-SHA256 with a per-user random salt at 210,000 iterations, the recommended figure for that algorithm.
• A wrong password and an unknown address give the same answer, in the same words, and take the same time, so sign-in cannot be used to discover which addresses exist.
• Eight failures locks an address for fifteen minutes.
• Sessions are signed, HTTP-only cookies.
• Forgotten passwords are reset by the person who owns the address: a one-time link that expires in thirty minutes, spends itself on use, and ends every other session on the account. It needs a sending domain, so on an instance with no mail configured the sign-in screen does not offer it and says an administrator can set the password instead.

Data boundaries

• Every database query is scoped to a school, enforced by a test over the data layer rather than by convention.
• Photographs live in a private bucket and are served only through the Worker to a signed-in member of staff.
• Answer keys, scores and pages all carry the school they belong to.

Audit

Confirming a key, overriding a score, matching a student, changing accommodations, setting a password and exporting are all recorded with who did it.

Not yet done

• No two-factor authentication.
• No single sign-on.