4:27 p.m.
Hey guys,
after 140 chars were not enough for matthias and bruno I decided to
subscribe to the list. ;)
1:
After working through aerogear-otp-java I took some hours to port it .NET.
If you are interested I would like to contribute it after cleanup.
Are you interested? :)
2:
Due to the fact that we are using Mobile-OTP in hour company I also took
some time and have implemented it.
PoC is working.
Pull-Request will be submitted if ready.
Question: I saw that the Clock-Implementation is returning a static value
for current time. So the token will be the same every time we call
Totp.now().
Is it really what developers are expecting?
If I call now, I expect the time it was called not created. :)
Why not just use System.currentMilliSeconds()? It is UTC. ;)
Bye,
Daniel
6:24 a.m.
Hey my friend, welcome! Answers inline.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Sunday, December 16, 2012 at 8:27 PM, Daniel Manzke wrote:
Hey guys,
after 140 chars were not enough for matthias and bruno I decided to subscribe to the
list. ;)
1:
After working through aerogear-otp-java I took some hours to port it .NET. If you are
interested I would like to contribute it after cleanup.
Are you interested? :)
I'm completely dumb on .net platform. Is it
(https://github.com/manzke/aerogear-otp-dotnet) compatible with windows phone?
2:
Due to the fact that we are using Mobile-OTP in hour company I also took some time and
have implemented it.
PoC is working.
Pull-Request will be submitted if ready.
Question: I saw that the Clock-Implementation is returning a static value for current
time. So the token will be the same every time we call Totp.now().
Not really, do
you have some scenario or unit test to reproduce it? The token will be the same during 30s
only.
Is it really what developers are expecting?
No, I'd appreciate if you gist the sources to reproduce it, then we can find out
what's wrong.
If I call now, I expect the time it was called not created. :)
Why not just use System.currentMilliSeconds()? It is UTC. ;)
I wouldn't like to
trust in Java while we're dealing with timezones. System.currentMilliSeconds also
works np on changing it, if the unit tests are passing.
Bye,
Daniel
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org (mailto:aerogear-dev@lists.jboss.org)
https://lists.jboss.org/mailman/listinfo/aerogear-dev
7:21 a.m.
Here we go:
Clock c = new Clock();
while(true){
System.out.println(c.getCurrentInterval());
Thread.sleep(1000);
}
c.getCurrentInterval() is always the same :)
2012/12/17 Bruno Oliveira <bruno(a)abstractj.org>
Hey my friend, welcome! Answers inline.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Sunday, December 16, 2012 at 8:27 PM, Daniel Manzke wrote:
> Hey guys,
>
> after 140 chars were not enough for matthias and bruno I decided to
subscribe to the list. ;)
>
> 1:
> After working through aerogear-otp-java I took some hours to port it
.NET. If you are interested I would like to contribute it after cleanup.
>
> Are you interested? :)
I'm completely dumb on .net platform. Is it (
https://github.com/manzke/aerogear-otp-dotnet) compatible with windows
phone?
>
> 2:
> Due to the fact that we are using Mobile-OTP in hour company I also took
some time and have implemented it.
> PoC is working.
> Pull-Request will be submitted if ready.
>
>
> Question: I saw that the Clock-Implementation is returning a static
value for current time. So the token will be the same every time we call
Totp.now().
Not really, do you have some scenario or unit test to reproduce it? The
token will be the same during 30s only.
>
> Is it really what developers are expecting?
No, I'd appreciate if you gist the sources to reproduce it, then we can
find out what's wrong.
>
> If I call now, I expect the time it was called not created. :)
>
> Why not just use System.currentMilliSeconds()? It is UTC. ;)
I wouldn't like to trust in Java while we're dealing with timezones.
System.currentMilliSeconds also works np on changing it, if the unit tests
are passing.
>
>
> Bye,
> Daniel
>
>
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org (mailto:aerogear-dev@lists.jboss.org)
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Viele Grüße/Best Regards
Daniel Manzke
7:49 a.m.
Hmm gotcha, a Clock instance will be created on Totp class. We're not using a single
instance of Clock to the whole implementation, just change the code for something like
this https://gist.github.com/250d78b8e19bc02319ee, might work.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Monday, December 17, 2012 at 11:21 AM, Daniel Manzke wrote:
Clock c = new Clock();
while(true){
System.out.println(c.getCurrentInterval());
Thread.sleep(1000);
}
7:52 a.m.
Yeah. Have a look at the pull request. ;)
I added a similar implementation, so one can choose which one to use. You
can pass a ExactClock into the Totp and it will work.
I think nothing here is right or wrong. Depends on what someone expect.
That's why the developer should choose the right clock. WDYT?
2012/12/17 Bruno Oliveira <bruno(a)abstractj.org>
Hmm gotcha, a Clock instance will be created on Totp class. We're
not
using a single instance of Clock to the whole implementation, just change
the code for something like this
https://gist.github.com/250d78b8e19bc02319ee, might work.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Monday, December 17, 2012 at 11:21 AM, Daniel Manzke wrote:
> Clock c = new Clock();
> while(true){
> System.out.println(c.getCurrentInterval());
> Thread.sleep(1000);
> }
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Viele Grüße/Best Regards
Daniel Manzke
4:33 p.m.
Hi Dan, and welcome to the list!!
I'm curious about the question Bruno had about the .NET support and windows phone. Is
that the target use-case for this? If so this is really cool, any chance of a little demo
to try it out on?
Thanks again,
Jay
On Dec 17, 2012, at 8:52 AM, Daniel Manzke wrote:
Yeah. Have a look at the pull request. ;)
I added a similar implementation, so one can choose which one to use. You can pass a
ExactClock into the Totp and it will work.
I think nothing here is right or wrong. Depends on what someone expect. That's why
the developer should choose the right clock. WDYT?
2012/12/17 Bruno Oliveira <bruno(a)abstractj.org>
Hmm gotcha, a Clock instance will be created on Totp class. We're not using a single
instance of Clock to the whole implementation, just change the code for something like
this https://gist.github.com/250d78b8e19bc02319ee, might work.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Monday, December 17, 2012 at 11:21 AM, Daniel Manzke wrote:
> Clock c = new Clock();
> while(true){
> System.out.println(c.getCurrentInterval());
> Thread.sleep(1000);
> }
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Viele Grüße/Best Regards
Daniel Manzke
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
5:33 a.m.
Hey Jay,
it should be the target that it can be used on Win8, WinRT and WinPhone.
I'll pass it to one of my developers, so that he checks if the goal can be
reached. I don't know any reason why not, but nobody knows. ;)
(it is only the token generator)
The project also includes a sample app. I think I'm going to port also the
Mobile-OTP implementation, which I have created.
The sample application is a console app which generates ongoing new tokens,
after you have passed your secret. ;)
2012/12/17 Jay Balunas <jbalunas(a)redhat.com>
Hi Dan, and welcome to the list!!
I'm curious about the question Bruno had about the .NET support and
windows phone. Is that the target use-case for this? If so this is really
cool, any chance of a little demo to try it out on?
Thanks again,
Jay
On Dec 17, 2012, at 8:52 AM, Daniel Manzke wrote:
Yeah. Have a look at the pull request. ;)
I added a similar implementation, so one can choose which one to use. You
can pass a ExactClock into the Totp and it will work.
I think nothing here is right or wrong. Depends on what someone expect.
That's why the developer should choose the right clock. WDYT?
2012/12/17 Bruno Oliveira <bruno(a)abstractj.org>
> Hmm gotcha, a Clock instance will be created on Totp class. We're not
> using a single instance of Clock to the whole implementation, just change
> the code for something like this
> https://gist.github.com/250d78b8e19bc02319ee, might work.
>
> --
> "The measure of a man is what he does with power" - Plato
> -
> @abstractj
> -
> Volenti Nihil Difficile
>
>
>
> On Monday, December 17, 2012 at 11:21 AM, Daniel Manzke wrote:
>
> > Clock c = new Clock();
> > while(true){
> > System.out.println(c.getCurrentInterval());
> > Thread.sleep(1000);
> > }
>
>
>
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
--
Viele Grüße/Best Regards
Daniel Manzke
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Viele Grüße/Best Regards
Daniel Manzke
9:55 a.m.
On Dec 16, 2012, at 8:27 PM, Daniel Manzke wrote:
Hey guys,
after 140 chars were not enough for matthias and bruno I decided to subscribe to the
list. ;)
1:
After working through aerogear-otp-java I took some hours to port it .NET. If you are
interested I would like to contribute it after cleanup.
Are you interested? :)
2:
Due to the fact that we are using Mobile-OTP in hour company I also took some time and
have implemented it.
PoC is working.
Pull-Request will be submitted if ready.
What is the RFC for it? My quick search
revealed nothing… is this non-standard?
Question: I saw that the Clock-Implementation is returning a static value for current
time. So the token will be the same every time we call Totp.now().
Is it really what developers are expecting?
If I call now, I expect the time it was called not created. :)
Why not just use System.currentMilliSeconds()? It is UTC. ;)
Bye,
Daniel
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
-- qmx
11:09 a.m.
I don't think that there is a official RFC. (I don't know one)
But: MOTP is used/supported by a lot of openid vendors and security
companies like CA.
In our company we are using it with RADIUS server for VPN access. There are
about 40 implementations.
We are preferring MOTP because it supports another level of security. With
TOTP you have to share a secret. This secret will be shared with the help
of a link or qrcode. This can be catched by a man in the middle attack.
In MOTP you also have a pin, which is used for token generation.
http://motp.sourceforge.net/
Bye,
Daniel
2012/12/18 Douglas Campos <qmx(a)qmx.me>
On Dec 16, 2012, at 8:27 PM, Daniel Manzke wrote:
> Hey guys,
>
> after 140 chars were not enough for matthias and bruno I decided to
subscribe to the list. ;)
>
> 1:
> After working through aerogear-otp-java I took some hours to port it
.NET. If you are interested I would like to contribute it after cleanup.
>
> Are you interested? :)
>
> 2:
> Due to the fact that we are using Mobile-OTP in hour company I also took
some time and have implemented it.
> PoC is working.
> Pull-Request will be submitted if ready.
What is the RFC for it? My quick search revealed nothing… is this
non-standard?
>
>
> Question: I saw that the Clock-Implementation is returning a static
value for current time. So the token will be the same every time we call
Totp.now().
> Is it really what developers are expecting?
> If I call now, I expect the time it was called not created. :)
>
> Why not just use System.currentMilliSeconds()? It is UTC. ;)
>
>
> Bye,
> Daniel
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
-- qmx
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Viele Grüße/Best Regards
Daniel Manzke
11:14 a.m.
This one is a good link which describes all otps and which clients supports
which spec.
http://www.clavid.com/index.php?option=com_content&task=view&id=1...
2012/12/18 Daniel Manzke <daniel.manzke(a)googlemail.com>
I don't think that there is a official RFC. (I don't know
one)
But: MOTP is used/supported by a lot of openid vendors and security
companies like CA.
In our company we are using it with RADIUS server for VPN access. There
are about 40 implementations.
We are preferring MOTP because it supports another level of security. With
TOTP you have to share a secret. This secret will be shared with the help
of a link or qrcode. This can be catched by a man in the middle attack.
In MOTP you also have a pin, which is used for token generation.
http://motp.sourceforge.net/
Bye,
Daniel
2012/12/18 Douglas Campos <qmx(a)qmx.me>
>
> On Dec 16, 2012, at 8:27 PM, Daniel Manzke wrote:
>
> > Hey guys,
> >
> > after 140 chars were not enough for matthias and bruno I decided to
> subscribe to the list. ;)
> >
> > 1:
> > After working through aerogear-otp-java I took some hours to port it
> .NET. If you are interested I would like to contribute it after cleanup.
> >
> > Are you interested? :)
> >
> > 2:
> > Due to the fact that we are using Mobile-OTP in hour company I also
> took some time and have implemented it.
> > PoC is working.
> > Pull-Request will be submitted if ready.
> What is the RFC for it? My quick search revealed nothing… is this
> non-standard?
>
> >
> >
> > Question: I saw that the Clock-Implementation is returning a static
> value for current time. So the token will be the same every time we call
> Totp.now().
> > Is it really what developers are expecting?
> > If I call now, I expect the time it was called not created. :)
> >
> > Why not just use System.currentMilliSeconds()? It is UTC. ;)
> >
> >
> > Bye,
> > Daniel
> > _______________________________________________
> > aerogear-dev mailing list
> > aerogear-dev(a)lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
> -- qmx
>
>
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
--
Viele Grüße/Best Regards
Daniel Manzke
--
Viele Grüße/Best Regards
Daniel Manzke
11:52 a.m.
Sorry Daniel, but I can't see how someone can intercept your phone's camera while
you're scanning the QRCode, doesn't exist any communication between the client and
the server. That's the reason why QRCode exists.
Here you can check more about how it works
http://aerogear.org/docs/specs/aerogear-security-otp/. IMO the idea of input a PIN, sounds
more like a HOTP, because it relies in some event to happen to have a new token. Add a
large delay window like 60s will expose you to the man-in-the-middle attacks, allowing to
reuse your token.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Tuesday, December 18, 2012 at 3:09 PM, Daniel Manzke wrote:
With TOTP you have to share a secret. This secret will be shared with
the help of a link or qrcode. This can be catched by a man in the middle attack
2:48 p.m.
The man-in-the-middle could be between your web client and server. You have
to call the server and than generate it. With XSS-Attacks there are a lot
of ways to read the qrcode.
This means the secret is exposed and you can generate a valid token. ;)
If you don't want the contribution I'm going to fork and have my own
version of aerogear-otp-java. No problem. ;)
2012/12/18 Bruno Oliveira <bruno(a)abstractj.org>
Sorry Daniel, but I can't see how someone can intercept your
phone's
camera while you're scanning the QRCode, doesn't exist any communication
between the client and the server. That's the reason why QRCode exists.
Here you can check more about how it works
http://aerogear.org/docs/specs/aerogear-security-otp/. IMO the idea of
input a PIN, sounds more like a HOTP, because it relies in some event to
happen to have a new token. Add a large delay window like 60s will expose
you to the man-in-the-middle attacks, allowing to reuse your token.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Tuesday, December 18, 2012 at 3:09 PM, Daniel Manzke wrote:
> With TOTP you have to share a secret. This secret will be shared with
the help of a link or qrcode. This can be catched by a man in the middle
attack
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Viele Grüße/Best Regards
Daniel Manzke
3:37 p.m.
I'm just trying to understand, the shared secret **can never** be sent across the
network, in our case that's the reason why you must scan the QRCode to generate
tokens, exactly to do not transmit it across the network.
So XSS attacks can decode an image and grab my secret? I'm interested in reproduce
this kind of attack, do you have the sources?
I didn't say nothing about contributions, I'm just curious about how you could
hack mobile's phone camera. I'd love to learn.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Tuesday, December 18, 2012 at 6:48 PM, Daniel Manzke wrote:
The man-in-the-middle could be between your web client and server.
You have to call the server and than generate it. With XSS-Attacks there are a lot of ways
to read the qrcode.
This means the secret is exposed and you can generate a valid token. ;)
If you don't want the contribution I'm going to fork and have my own version of
aerogear-otp-java. No problem. ;)
2012/12/18 Bruno Oliveira <bruno(a)abstractj.org (mailto:bruno@abstractj.org)>
> Sorry Daniel, but I can't see how someone can intercept your phone's camera
while you're scanning the QRCode, doesn't exist any communication between the
client and the server. That's the reason why QRCode exists.
>
> Here you can check more about how it works
http://aerogear.org/docs/specs/aerogear-security-otp/. IMO the idea of input a PIN, sounds
more like a HOTP, because it relies in some event to happen to have a new token. Add a
large delay window like 60s will expose you to the man-in-the-middle attacks, allowing to
reuse your token.
>
>
> --
> "The measure of a man is what he does with power" - Plato
> -
> @abstractj
> -
> Volenti Nihil Difficile
>
>
>
> On Tuesday, December 18, 2012 at 3:09 PM, Daniel Manzke wrote:
>
> > With TOTP you have to share a secret. This secret will be shared with the help
of a link or qrcode. This can be catched by a man in the middle attack
>
>
>
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org (mailto:aerogear-dev@lists.jboss.org)
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Viele Grüße/Best Regards
Daniel Manzke
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org (mailto:aerogear-dev@lists.jboss.org)
https://lists.jboss.org/mailman/listinfo/aerogear-dev
3:48 p.m.
I know you have more experiences at this stage than me.
I don't worry about hacking the phone. But somewhere the QRCode has to be
generated. It is often done with things lik jquery.qrcode(uri). The uri has
to be retrieved from the backend to be able to generate the qrcode.
I could assume an attack at the qrcode generation stage, due to the fact
that this is done in javascript.
So the risk is not the phone, it is the browser where the qrcode will be
displayed.
wdyt? :)
2012/12/18 Bruno Oliveira <bruno(a)abstractj.org>
I'm just trying to understand, the shared secret **can never** be
sent
across the network, in our case that's the reason why you must scan the
QRCode to generate tokens, exactly to do not transmit it across the network.
So XSS attacks can decode an image and grab my secret? I'm interested in
reproduce this kind of attack, do you have the sources?
I didn't say nothing about contributions, I'm just curious about how you
could hack mobile's phone camera. I'd love to learn.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Tuesday, December 18, 2012 at 6:48 PM, Daniel Manzke wrote:
> The man-in-the-middle could be between your web client and server. You
have to call the server and than generate it. With XSS-Attacks there are a
lot of ways to read the qrcode.
> This means the secret is exposed and you can generate a valid token. ;)
>
> If you don't want the contribution I'm going to fork and have my own
version of aerogear-otp-java. No problem. ;)
>
>
> 2012/12/18 Bruno Oliveira <bruno(a)abstractj.org (mailto:
bruno(a)abstractj.org)>
> > Sorry Daniel, but I can't see how someone can intercept your phone's
camera while you're scanning the QRCode, doesn't exist any communication
between the client and the server. That's the reason why QRCode exists.
> >
> > Here you can check more about how it works
http://aerogear.org/docs/specs/aerogear-security-otp/. IMO the idea of
input a PIN, sounds more like a HOTP, because it relies in some event to
happen to have a new token. Add a large delay window like 60s will expose
you to the man-in-the-middle attacks, allowing to reuse your token.
> >
> >
> > --
> > "The measure of a man is what he does with power" - Plato
> > -
> > @abstractj
> > -
> > Volenti Nihil Difficile
> >
> >
> >
> > On Tuesday, December 18, 2012 at 3:09 PM, Daniel Manzke wrote:
> >
> > > With TOTP you have to share a secret. This secret will be shared
with the help of a link or qrcode. This can be catched by a man in the
middle attack
> >
> >
> >
> > _______________________________________________
> > aerogear-dev mailing list
> > aerogear-dev(a)lists.jboss.org (mailto:aerogear-dev@lists.jboss.org)
> > https://lists.jboss.org/mailman/listinfo/aerogear-dev
>
>
>
>
> --
> Viele Grüße/Best Regards
>
> Daniel Manzke
> _______________________________________________
> aerogear-dev mailing list
> aerogear-dev(a)lists.jboss.org (mailto:aerogear-dev@lists.jboss.org)
> https://lists.jboss.org/mailman/listinfo/aerogear-dev
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
--
Viele Grüße/Best Regards
Daniel Manzke
7:22 a.m.
Not really, we're all here to have some fun, learn and write code. Currently we're
running our demo on the same server and we do not recommend our devs to do some different
than this, if someone can intercept our JQuery call, so the server was compromised.
If you want to have 2 servers, one to generate the QRCode and another to your endpoints, I
suggest a DMZ and maybe Honeypots for this.
As described at our docs, on the next releases we have some plans for the shared secret
expiration, for example. Some risks can be mitigated, but of course, we can always learn,
improve and try to make it even better.
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
On Tuesday, December 18, 2012 at 7:48 PM, Daniel Manzke wrote:
I know you have more experiences at this stage than me.
4906
days inactive
4909
days old
14 comments
4 participants
participants (4)
-
Bruno Oliveira -
Daniel Manzke -
Douglas Campos -
Jay Balunas