stellar/stellar-wallet — pull request #44 by nullstyle (2014-10-30 23:37:53+00:00)
Title: Add username to signed json, remove uniqueness on walletID

This PR closes the "collide with walletID to verify a password" threat. It does this by introducing the username into any situation where we get a wallet by walletID, most notably when we lookup the publicKey for a wallet to verify a signed request.

By removing the uniqueness constraint on `walletID` we now are not vulnerable to an attacker repeatedly creating dummy wallets with an online dictionary attack that determines success by colliding with walletID.