Use of weak ciphers

[alexxsanya]

Hello,

First of all, thanks for the good work on this package. We use it in our enterprise app - we love it.

Recently, we scanned for security issues in the app and this came up. This package was found to be using weak ciphers (MD5 and/or SHA1). See below.

The report recommends that one should use stronger ciphers like SHA256. Is this something you plan on looking into in the near future?

[mikehardy]

We simply wrap the underlying firebase-ios-sdk and firebase-android-sdk libraries, while matching the firebase-js-sdk API as much as possible as we do so.

Those libraries use an md5 hash for firebase storage files.

https://firebase.google.com/docs/reference/js/firebase.storage.FullMetadata#md5hash

You'll want to take this up with them, as we will have it as long as they do

[alexxsanya]

Thank you so much @mikehardy for clarifying this.