Imagestonks (fixed data persistence)

MineTurte

Imagestonks
A work in progress website in which users can buy and sell uploaded images for virtual currency. All user uploads are inaccessible until the image has been verified by an admin (so far only me). Virtual currency cannot be transferred into cash or bought with cash. For all information read the README on the repository.

Do NOT use any passwords used on other websites or apps to make accounts in imagestonks. While I have put some effort into intermediate security, it is NOT very good.

Homepage

Explore page

Uploading page

Logged-in user inventory

Time rewards

User profile

Item

Last edited by MineTurte (Aug. 28, 2026 15:15:11)

TechNerd64

This looks cool! Now I don't know what security methods you have added to secure user data and login, but hashing may be an option if it's not added already. You could store the SHA-256 hash of the username and password instead of the raw string that way you only have to compare hashes to verify logins. Again, if this is already added, then amazing! I will likely be making something on this site

scratchcode1_2_3

oh shoot i made my password super easy i might be cooked

TechNerd64 wrote:
(#2)
You could store the SHA-256 hash of the username and password instead of the raw string that way you only have to compare hashes to verify logins.

IT'S STORED AS A RAW STRING???????????
Also….. I know it's just a hobby site or whatever but SHA-256 are meant for things like file hashing and checksums (checking the integrity of a file to make sure it hasn't been tampered with) in a fast manner, which is why its fast. Fast hashes are bad since the way a password can get cracked is by brute forcing it, and SHA-256 hashes make it extremely easy to brute force through thousands if not tens of thousands of password tries every second. Use argon2id or bcrypt if security is really a priority.

Now, I haven't put anything sensitive into the site, I'm just worried someone takes over my account and posts something inappropriate as me and then I get banned or canceled or something

TechNerd64

scratchcode1_2_3 wrote:
oh shoot i made my password super easy i might be cooked
TechNerd64 wrote:
(#2)
You could store the SHA-256 hash of the username and password instead of the raw string that way you only have to compare hashes to verify logins.
IT'S STORED AS A RAW STRING???????????
Also….. I know it's just a hobby site or whatever but SHA-256 are meant for things like file hashing and checksums (checking the integrity of a file to make sure it hasn't been tampered with) in a fast manner, which is why its fast. Fast hashes are bad since the way a password can get cracked is by brute forcing it, and SHA-256 hashes make it extremely easy to brute force through thousands if not tens of thousands of password tries every second. Use argon2id or bcrypt if security is really a priority.

Now, I haven't put anything sensitive into the site, I'm just worried someone takes over my account and posts something inappropriate as me and then I get banned or canceled or something

no it's not necessarily stored as a raw string, I haven't been able to look at the codebase to check security, so i don't know what methods are being used. Also to prevent such brute-force attacks one could add rate-limiting by logging ip addresses, but yes there are likely other better methods of security.

scratchcode1_2_3

the passwords are in local storage

im crineeeeeeeeeeeeeeeeeeeeeeeee

function login() {
    const username = document.getElementById("username").value
    const password = document.getElementById("password").value
    async function handleLogin() {
        (removed)
        const status = response.status;
        const data = await response.json();
        if(status !== 200) {
            document.getElementById("status").innerHTML = data.message
        } else {
            localStorage.setItem("username", username)
            localStorage.setItem("password", password)
            let last = localStorage.getItem("last")
           (removed)
            window.location.href = last; 
        }
    }
    handleLogin();
}
function createAccount() {
    const username = document.getElementById("username").value
    const password = document.getElementById("password").value
(removed)
}

(the removed are cuz these parts keep triggering the filter for some reason)

Last edited by scratchcode1_2_3 (Aug. 28, 2026 01:49:33)

scratchcode1_2_3

TechNerd64 wrote:
(#4)
Also to prevent such brute-force attacks one could add rate-limiting by logging ip addresses, but yes there are likely other better methods of security

i meant offline attacks where you can locally test the hashes using a gpu and a dictionary

o97doge

scratchcode1_2_3 wrote:
the passwords are in local storage im crineeeeeeeeeeeeeeeeeeeeeeeee
[…]

Phish and chips, anyone? But in all seriousness, you should probably verify with a session token instead of stuffing the password into Local Storage.

scratchcode1_2_3

o97doge wrote:
(#7)
scratchcode1_2_3 wrote:
the passwords are in local storage im crineeeeeeeeeeeeeeeeeeeeeeeee
[…]
Phish and chips, anyone? But in all seriousness, you should probably verify with a session token instead of stuffing the password into Local Storage.

it should be an httpOnly token so XSS can't see it (nor pasting stuff in the console)

MineTurte

scratchcode1_2_3 wrote:
oh shoot i made my password super easy i might be cooked
TechNerd64 wrote:
(#2)
You could store the SHA-256 hash of the username and password instead of the raw string that way you only have to compare hashes to verify logins.
IT'S STORED AS A RAW STRING???????????
Also….. I know it's just a hobby site or whatever but SHA-256 are meant for things like file hashing and checksums (checking the integrity of a file to make sure it hasn't been tampered with) in a fast manner, which is why its fast. Fast hashes are bad since the way a password can get cracked is by brute forcing it, and SHA-256 hashes make it extremely easy to brute force through thousands if not tens of thousands of password tries every second. Use argon2id or bcrypt if security is really a priority.

Now, I haven't put anything sensitive into the site, I'm just worried someone takes over my account and posts something inappropriate as me and then I get banned or canceled or something

YES LOL

it would be so easy to encode it but like ehhhh its open source anyways so you can easily find out how I encoded passwords and whatnot

Last edited by MineTurte (Aug. 28, 2026 14:13:03)

MineTurte

o97doge wrote:
scratchcode1_2_3 wrote:
the passwords are in local storage im crineeeeeeeeeeeeeeeeeeeeeeeee
[…]
Phish and chips, anyone? But in all seriousness, you should probably verify with a session token instead of stuffing the password into Local Storage.

looking into user data there is a session token in place but I ended up not using it. Eventually I might implement it but for now I dont think it really matters lol. Just don't run suspicious javascript in the console.

MineTurte

also I don't know WHAT happened because it looks like all the data randomly got wiped for no reason… uhh so thats weird..

I didn't reset or republish the website after I took the images in the original post and yet everything got wiped???? aughuhgua

edit: i hate replit. Turns out I have to link it to an actual replit database because autoscale published apps RESTART CONSTANTLY… how did I not know this…. ok hoooold

Last edited by MineTurte (Aug. 28, 2026 14:23:36)

MineTurte

Okay data is now persistent through restarts and re-publishing!

this also means I can update the website without data resetting every time.

Last edited by MineTurte (Aug. 28, 2026 15:15:50)

MineTurte

scratchcode1_2_3 wrote:
Now, I haven't put anything sensitive into the site, I'm just worried someone takes over my account and posts something inappropriate as me and then I get banned or canceled or something

Added a case example for this in uploading guidelines. Since I can see logs of everything, if I notice an account was logged into and then posted an image that breaks the guidelines, I will take that into account and just revoke uploading privileges until the user messages me with sufficient evidence.

Discuss Scratch