Security

Passwords are hashed with Argon2id at the memory, time and parallelism settings OWASP recommends. They are never stored, logged, or recoverable, and a password reset sets a new one rather than revealing the old one.

Signing in against an address that does not exist takes the same amount of time as signing in with the wrong password, deliberately. Otherwise the difference in timing tells an attacker which addresses have accounts.

Changing your password signs out every other session immediately. If somebody had your account, changing the password ends their access rather than leaving them signed in.

The session cookie is short lived and cannot be read by JavaScript. A separate long-lived refresh token renews it, and that token rotates on every use.

Because it rotates, presenting one that has already been used means either a broken retry or a stolen token. We cannot tell which, so we assume the worse one: the entire session family is revoked and everybody signs in again. That is inconvenient roughly never and correct every time it matters.

An upload is identified by reading its actual bytes rather than trusting its name or the type the browser claims. SVG is refused outright, because it is a document format that can contain script.

Every image is decoded and re-encoded before it is stored, which removes camera metadata and any GPS coordinates embedded by the device that took it. The original file is never served.

Files are stored under server-generated keys. A client never supplies a path, and a key that tried to escape the storage directory would be rejected twice on the way through.

Coordinates are rounded to roughly a kilometre before they are written. The precise point you entered is not stored, so it cannot be disclosed by a bug, a breach, or a subpoena.

Other members see a band rather than a number: same area, nearby, a short trip, or far. Distances that can be read precisely from several accounts can be used to triangulate a home address.

IP addresses are stored only as keyed hashes. That is enough to recognise the same source attacking an account repeatedly, and not enough to produce a list of where anybody connects from.

The same applies to the coarse device signature used to detect referral fraud. It is built from headers a browser sends anyway, never from anything requiring extra permission.

Administrators sign in through a separate system with its own credential and a much shorter session. A member session cannot reach an administrative endpoint, and the reverse is also true.

The roles that can act on accounts require a second factor before they can sign in at all, not as a setting somebody can skip, but as a condition of the role.

Opening a case is recorded, as is every action taken and every attempt that was refused. Reading somebody's reported messages is an exercise of access, not a neutral act, and it leaves a trace.

Moderators never see who reported a member. That is enforced by what the server selects, not by what the interface displays.

The site sends a restrictive content security policy, refuses to be framed, sends no referrer to other sites, and does not advertise the framework it runs on.

Fonts are served from our own origin. Nothing about who is reading a page is sent to a font provider or any other third party.

If you find a vulnerability, we would rather hear about it than not. Send the details to security@duskmeet.com, including enough to reproduce it.

We will not pursue anybody who reports a genuine issue in good faith and does not access, modify, or retain data belonging to other people. There is no paid bounty programme.

For anything about your own data rather than a vulnerability, use your data.