05/22 Enhance codes and fix bugs 2

app/static/js/vault.js

@@ -3442,13 +3442,23 @@ const Vault = (() => {
         return;
       }
 
+      // Use the user's email as a per-user PBKDF2 salt so precomputed tables
+      // cannot attack multiple users at once.
+      const meRes = await apiFetch("/api/auth/me");
+      if (!meRes || !meRes.ok) {
+        showToast("Session error. Please reload.", "error");
+        return;
+      }
+      const meData = await meRes.json();
+      const userEmail = meData.email;
+
       // Generate a random 128-bit (16-byte) recovery code displayed as hex
       const rawBytes = window.crypto.getRandomValues(new Uint8Array(16));
       const recoveryCode = Array.from(rawBytes)
         .map((b) => b.toString(16).padStart(2, "0"))
         .join("");
 
-      // Derive recovery key from the code
+      // Derive recovery key from the code using the user's email as PBKDF2 salt
       const recoveryKeyMaterial = await window.crypto.subtle.importKey(
         "raw",
         new TextEncoder().encode(recoveryCode),
@@ -3459,7 +3469,7 @@ const Vault = (() => {
       const recoveryKey = await window.crypto.subtle.deriveKey(
         {
           name: "PBKDF2",
-          salt: new TextEncoder().encode("passkeeper-recovery"),
+          salt: new TextEncoder().encode(userEmail),
           iterations: 200_000,
           hash: "SHA-256",
         },