[aerogear-dev] [OTP] Mobile-OTP / OTP for .NET

[Daniel Manzke]

I know you have more experiences at this stage than me.

I don't worry about hacking the phone. But somewhere the QRCode has to be
generated. It is often done with things lik jquery.qrcode(uri). The uri has
to be retrieved from the backend to be able to generate the qrcode.
I could assume an attack at the qrcode generation stage, due to the fact
that this is done in javascript.

So the risk is not the phone, it is the browser where the qrcode will be
displayed.

wdyt? :)


2012/12/18 Bruno Oliveira <bruno at abstractj.org>

> I'm just trying to understand, the shared secret **can never** be sent
> across the network, in our case that's the reason why you must scan the
> QRCode to generate tokens, exactly to do not transmit it across the network.
>
> So XSS attacks can decode an image and grab my secret? I'm interested in
> reproduce this kind of attack, do you have the sources?
>
> I didn't say nothing about contributions, I'm just curious about how you
> could hack mobile's phone camera. I'd love to learn.
>
> --
> "The measure of a man is what he does with power" - Plato
> -
> @abstractj
> -
> Volenti Nihil Difficile
>
>
>
> On Tuesday, December 18, 2012 at 6:48 PM, Daniel Manzke wrote:
>
> > The man-in-the-middle could be between your web client and server. You
> have to call the server and than generate it. With XSS-Attacks there are a
> lot of ways to read the qrcode.
> > This means the secret is exposed and you can generate a valid token. ;)
> >
> > If you don't want the contribution I'm going to fork and have my own
> version of aerogear-otp-java. No problem. ;)
> >
> >
> > 2012/12/18 Bruno Oliveira <bruno at abstractj.org (mailto:
> bruno at abstractj.org)>
> > > Sorry Daniel, but I can't see how someone can intercept your phone's
> camera while you're scanning the QRCode, doesn't exist any communication
> between the client and the server. That's the reason why QRCode exists.
> > >
> > > Here you can check more about how it works
> http://aerogear.org/docs/specs/aerogear-security-otp/. IMO the idea of
> input a PIN, sounds more like a HOTP, because it relies in some event to
> happen to have a new token. Add a large delay window like 60s will expose
> you to the man-in-the-middle attacks, allowing to reuse your token.
> > >
> > >
> > > --
> > > "The measure of a man is what he does with power" - Plato
> > > -
> > > @abstractj
> > > -
> > > Volenti Nihil Difficile
> > >
> > >
> > >
> > > On Tuesday, December 18, 2012 at 3:09 PM, Daniel Manzke wrote:
> > >
> > > > With TOTP you have to share a secret. This secret will be shared
> with the help of a link or qrcode. This can be catched by a man in the
> middle attack
> > >
> > >
> > >
> > > _______________________________________________
> > > aerogear-dev mailing list
> > > aerogear-dev at lists.jboss.org (mailto:aerogear-dev at lists.jboss.org)
> > > https://lists.jboss.org/mailman/listinfo/aerogear-dev
> >
> >
> >
> >
> > --
> > Viele Grüße/Best Regards
> >
> > Daniel Manzke
> > _______________________________________________
> > aerogear-dev mailing list
> > aerogear-dev at lists.jboss.org (mailto:aerogear-dev at lists.jboss.org)
> > https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
>
>
>
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>



-- 
Viele Grüße/Best Regards

Daniel Manzke
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/aerogear-dev/attachments/20121218/f60eecde/attachment.html