Viewing profile — jonoberheide

Hi Paul! I believe your token should automatically resync if you enter three consecutive correct passcodes that are outside (but forward of) the current valid window.

I think that's a fair read. The primary use of that data is for security use cases. Eg. if you're coming from an out-of-date browser or have risky Java/Flash plugin versions, we ca…

No prob! I can't claim to be a HN veteran (/me glares at @tqbf), but if I hear people are having issues, happy to help.

Sorry to hear about your experience, Jarwain! Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organizatio…

If anyone can quickly point me at the CM9 kernel source, I can verify whether or not this is actually patched. The vulnerability is looking checking to see if the mem_write() funct…

4.1 is definitely the most secure Android you can be running currently. We posted about some of the security improvements in Jelly Bean 4.1 last week: https://blog.duosecurity.com/…

We'd love to be able to publish it in the Play Store, but we were informed by Google that the terms of service disallow any apps that check for vulnerabilities, despite X-Ray's goo…

X-Ray author here, happy to answer any questions folks have!

FYI, it is possible for unprivileged apps to invoke the INSTALL_ASSET functionality themselves. One such example described here: http://blog.duosecurity.com/2011/05/when-angry-bird…

Yeah, I'm guessing ARM will be ok with respect to GPRs (although I certainly haven't done any benchmarks). Dug's FUBAR comment was just an attempt cram in as many acronyms as possi…

GRKERNSEC_BRUTE will also trigger for suid binaries (in the case of memprodroid, run-as). See gr_handle_brute_attach() for details.

Yeah, mempodroid is a great example. You'd need to randomize the location of the setuid executable (w/PIE), randomize of the linker, and implement something like GRKERNSEC_BRUTE to…

Right, all libaries need to be compiled with -fPIC in order to be randomized. That tends to be much more common than -fPIE.

There's still a large attack surface of native code in the Android platform. I've heard WebKit has a few bugs... :-P

Duo offers a number of features above and beyond Google Authenticator: - more flexibility in choice of authentication method (voice, SMS, soft token, hard token, Duo Push) - more s…

Check out the login_duo(8) man page. You can specify a failmode configuration option to fail safe (allow access) or fail secure (deny access) if there is a connectivity loss betwee…