The DMZ

1:18 AM

if i have a webtotp prototype solution and would like feedback to see if I'm missing any security flaws would this site be an ok place to ask?

forest

twitter.com/Dwokfur/status/1357762168272408581

@J-- If you're interesting in hardware security: igor-blue.github.io/2021/02/04/secure-boot.html

@depperm Dunno. We can't analyze complete designs for you, but we can help if you have specific questions.

depperm

so if I asked about security flaws in a web based TOTP app (app prototype: depperm.github.io) is that too broad?

forest

@J-- More interesting hw stuff: dramsec.ethz.ch

@depperm Depends on the question. You can always ask and see.

But a question that boils down to "is it secure" would not be on-topic.

depperm

1:42 AM

@forest the question would boil down to what security flaws are there besides x, y, and z.

forest

@depperm I guess it depends on how you word it and if you specify a threat model. Worst case, the question gets closed. Best case, you get a good answer.

Derpy

10:17 AM

morning. I don't think this would fit the main site, but I am curious to see if someone here can give me a tech reason / explanation for this behavior

Premise: I don't have access to the actual hardware involved, this is something a friend told me

Basically, they own a small 4g router/modem from a local Internet provider.

The modem works "fine", they just use it as a secondary connection to play games on consoles due to issues with the main connection coverage

the weird thing is that when the modem is turn on, the console can connect to it just fine.... yet, the internet connection won't work..... until they visit a specific site from the internet provider.

Journeyman Geek

sounds like a captive portal

Derpy

After that, all works normally until the modem is shut down for some hours...

Next day, the same procedure will be required.

The site in question is a portal that shows you the data for your sim - number, credit, used GB on your offer etc

it does so without any auth - that I guess is easy to do... after all the provider has to know your identity, so it can provide a personalized reply

Problem: the site now has a banner that warns of a "some time in the future" shut off, and a replacement smart phone app that requires a login (YAY! FREE SPAM!!!!)

so, the fear here is that since the modem REQUIRES access to that site to work...

what will happen if the site is killed?

@JourneymanGeek interesting, didn't know the term

Journeyman Geek

10:35 AM

No idea

Derpy

I admit my ignorance, had to look up what a captive portal is on google...

But, it seems quite "stupid" to kill the portal of your captive portal infrastructure...

Journeyman Geek

maybe different auth methods

our local free wifi net went from captive portal to a 802.11x cert system managed by... a smart phone app

they'll need to check with the ISP though. It isn't exactly a security issue

Derpy

@JourneymanGeek that said, why have a captive portal on a paid offer?

Journeyman Geek

10:51 AM

\o/

Derpy

11:05 AM

I mean, maybe I was not clear...

> Captive portals are commonly used to present a landing or log-in page which may require authentication, payment, acceptance of an end-user license agreement, acceptable use policy, survey completion, or other valid credentials that both the host and user agree to adhere by

just to use the wikipedia description. Not great, I know, but it gets the point.

Journeyman Geek

Its a landing page ;)

Derpy

We are talking about a 4g modem with a sim inside, and you pay a monthly fee for a fixed monthly total available GB traffic.

there is no password or other user initiated authentication involved

Journeyman Geek

as far as you know

Derpy

I said user initiated

my friend does not need to input anything on the page, they just have to visit it

so, if there is some form of authentication, it is automated by the router/modem (I assume it uses a customized firmware)

so, it seems stupid in a way, only an annoyance that provide no real security whatsoever

Furthermore....

> Captive portals often require the use of a web browser; this is usually the first application that users start after connected to the Internet, but users who first use an email client or other application that relies on the Internet may find the connection not working without explanation, and will then need to open a web browser to validate. This may be problematic for users who do not have any web browser installed on their operating system.

the device is a portable 4g modem, devised to be small and easy to bring with you and use in case you need to have internet access anywhere and you don't have other options.

Again, seem stupid to implement a captive portal that requires a browser

May I add... a recent browser that support some specific technologies.

I am quite sure that wouldn't probably work if someone tries to connect a PS Vita, for example

Anonymous

12:30 PM

@forest I don't particularly, no. This is from a general introduction to LFSRs for building a key stream for Stream ciphers.

Anonymous

I am just very confused why the placement of P_0, etc is different on each diagram.

Anonymous

Not even sure this would be a useful question I could post on cryptoex since it is likely a mistake.

ThoriumBR

2:13 PM

good morning guys... shitty day down here...

Fire Quacker

7:04 PM

Are these questions duplicates?

8

Q: Is it secure to store a two factor authentication seed in a password manager?

I wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If someone gets access to the decrypted password database (e.g. while the password manager is unlock...

2

Q: Storing 2FA seeds in a password manager

Does it make sense to store the 2FA seeds (i.e: the codes used to generate a time based OTP) in my password manager? If my password manager has a strong password and 2FA using a third-party app, is storing 2FA seeds for the accounts saved in my password manager poor practice? Ultimately I would e...

password-management multi-factor

6

Q: Why would password managers provide support for OTP codes?

Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been fighting for the adoption of 2FA for a long time, and now that we are reaching a wider coverage, ...

authentication passwords password-management multi-factor

Anonymous

8:12 PM

@forest Turns out it was a printing issue :D

Anonymous

8:28 PM

Hey @MechMK1 :D

Transcript for