Class InviteToken

Namespace

Tharga.Team

Assembly

Tharga.Team.dll

Generates the code that authorizes accepting an invitation.

public static class InviteToken

Inheritance

object

InviteToken

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

This value is a bearer credential. Anyone holding it can join the team it names, so it is generated from RandomNumberGenerator and nothing else. Guid.NewGuid() is the tempting alternative and is not equivalent: its version and variant bits are fixed, so it carries 122 bits rather than 128, and nothing in its contract promises unpredictability — only uniqueness.

Short is the point. Twenty-two characters against the ninety-odd of the base64-JSON code it replaces, and it discloses nothing: the previous format carried the team key in plain sight, readable by any mail relay, helpdesk ticket or forwarded message that touched the link (Tharga/Team#249).

Fields

ByteCount

Nine bytes — 72 bits, and twelve base64url characters with no padding to strip.

public const int ByteCount = 9

Field Value

int

Remarks

Chosen against the attack rather than by rounding to a familiar number. The realistic attack is online guessing against the whole pool of outstanding invitations at once, not against one code: any hit joins a team, and resolving tells the caller which team, so a hit announces itself. At 72 bits, a hundred thousand distinct sources guessing continuously against a pool of a thousand live invitations reach even odds in roughly six million years.

Shorter was considered and rejected with numbers. At 36 bits — six characters — the same attack succeeds in under an hour, and rate limiting does not rescue it: a per-source throttle is strong against one attacker and close to worthless against a distributed one. The saving was ten characters of a link whose host and path are most of its length.

Length

Length of the generated token, in characters.

public const int Length = 12

Field Value

int

Methods

New()

A new token.

public static string New()

Returns

string