Live data from Hacker News

Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

blog.teller.io

71–80 of 186 posts

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#71
By logging into a 3rd-party site using Google+, for instance, you remain logged-in to Google when you go to any other web site.

And the authenticator clearly does not require this global behavior: if you immediately log out from a Google page, you remain “logged in” at the 3rd-party site that you started from. So why doesn’t it log you out globally? Probably to convenience Google, at the expense of security when you auto-identify yourself to who knows how many other web sites before you realize what happened.

Logging into one page with one set of permissions should mean “LOG INTO THIS PAGE”, not “REVEAL MY SECRETS TO THE INTERNET”.

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#72

In my opinion, having worked extensively with OAuth2 (mostly in the form of OIDC) and other modern AuthN/Z protocols, the author of this post does not truly understand OAuth 2, nor have they looked in any appropriate depth into supplements like OIDC or alternatives. For one, bearer token [1] is only one type of "Access Token" described by the OAuth2 spec [2]. In fact, the OAuth2 spec is very vague on quite a few impl…

As a developer currently working with OpenID Connect (OIDC) and JSON Web Token (JWT), using curl is indeed not a problem at all:

    curl -i ... // Perform authentication to obtain JWT
    export JWT="eY..." // Place JWT in a shell variable
    curl -i -H "Authorization: Bearer $JWT" ... // Call your API
That's all there is to it.

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#73

> The most realistic threat is the client developer not properly verifying the server certificate, i.e. was it ultimately signed by a trusted certificate authority? From an attackers point of view, this sounds like a very tiny ray of hope. It sounds like a cool feature/vulnerability that will probably be going away soon because it is so easy to fix.

The problem with the, "was it signed by a trusted authority?" concept is that you generally can't automated the 3rd party since they're not under your control. Also, they typically charge every time you request a new certificate (even if client-only). The solution to that is to run your own CA but then it won't be 3rd party anymore. It's sort of the catch-22 with SSL/TLS: Either you use a 3rd party or you get to auto…

"client developer not properly verifying the server certificate" makes it sound possible, but I think I understand the problem now maybe.

The 3rd party CA may have issued a cert to malicious party that issued another cert to their man in the middle.

You can't be sure unless you are your own CA, but then you aren't a 3rd party anymore.

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#74
post #60

Earlier quoted context omitted.

What's to stop the app (or anyone in the context of a rooted device) replacing the legit Mondo auth page with a shim? Nothing.

Yup. That's every app's problem though. I can also create a webpage and design a fake "bank login" inside of it to make you enter your credentials there. There is nothing you can do about that other than educating the user.

Yes, but browsers design goal is to allow educated users to distinguish fake and legitimate sites (URL bar should never be forgeable). With mobile apps, the app can display anything and there is no way for even well educated user to recognize forgeries.

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#75
post #30

Some features that I think a system like this should have: 1. The client (or the device holding the authentication token, or the app, etc) should be able to maintain (on its own storage!) an audit log of all transactions it has authorized, that log should be cryptographically verifiable to be append-only (think blockchain but without all the Bitcoin connotations), and the server should store audit log hashes and veri…

1. Is an awesome idea. Will it work for the tail-end of the log where most maliciousness will occur? The scenario I see is the hacker grabbing the log, and appending transactions to its copy of the log. When you go to contest those transactions, the bank will have a longer log than what your client has. Don't get me wrong there's a lot of use-cases for this: You received a confirmation that a transaction was cancelle…

I would expect the local device audit log to store the server's signed acknowledgement too. With 2-party asymmetric signing this should be pretty much airtight.

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#76
I think my biggest bug here is that as far as I understand this flow, it essentially says that a given certificate that is generated and signed by a third party (Teller in this case) would be expected to bundle this private certificate with the application. Isn't it possible to extract the certificate from the app bundle after the fact? Or am I missing something here...

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#77

Relying on SMS for bank security has always seemed crazy to me. It's not secure. Didn't Telegram creator just got hacked by the Russian mobile provider that sent an SMS to itself?

And they're sending the SMS auth token before the password is validated, which opens them up to either spamming a phone's text msgs or Denial of Service if they (or the carrier) impose rate limiting.

TOTP should always be used before SMS auth, and SMS auth should always be used in addition to an offline secret (separate from a password). It's just too easy to abuse the unencrypted, open-network nature of SMS.

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#78
post #46

Their description of the MITM attack is entirely dependent upon how the authorization server validates redirects in the implicit and authorization code grant flows. This is tied to how client registration is performed. So, if you want to ensure that the authorization code or access token is only delivered to a redirect URI that is trusted, that should be part of the policy enforced in your infrastructure... More spec…

These are two separate things: MITM and open redirect. A MITM attack is not on the the auth code, but on the bearer token.

By design, OAuth2 doesn't allow for open redirects: this is just part of how clients are registered. What I'm getting at is not strongly validating the registered redirects on a sensitive client, which can lead to leakage of the access token in the implicit flow and the authorization code grant flow. Once you perform that intercept, the token may be presented by a malicious third party until it expires or is revoked.

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#79
post #60

Earlier quoted context omitted.

Yup. That's every app's problem though. I can also create a webpage and design a fake "bank login" inside of it to make you enter your credentials there. There is nothing you can do about that other than educating the user.

Yes, but browsers design goal is to allow educated users to distinguish fake and legitimate sites (URL bar should never be forgeable). With mobile apps, the app can display anything and there is no way for even well educated user to recognize forgeries.

The aim is therefore to remove the reliance on it being genuine. If you don't have passwords then there is no passwords to steal.

Re: Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

#80

This is unnecessary. Many banks can and will enforce 2-factor authentication with their oauth flow, which sufficiently validates the client and would prevent a MITM attack. Your whole premise is surrounded by the threat a client browser would not properly validate a server certificate... come on... really?

You do know about phishing, right? There are many ways to get a user (not client) to accept an invalid cert, and some cases where a client will accept an invalid cert.

They want cryptographic proof of client identity. That means somehow the client has to prove they are the real user and not an attacker who intercepted the connection somehow (which, again, is completely possible). Client certs are a way to verify with each message that the user themselves, using their private key, validate what's going on, and that the message they validated came from the real server and not a fake intermediary.

This is different from 2fa because 2fa is authentication of identity that only happens once and does not provide cryptographic proof of identity. TOTP will give you something closer, but it's still a "dumb token" that can be intercepted.

tl;dr

2fa:

  Client request 1: "Gimme $5."
  Bank reply 1:     "Who are you?"
  
  Client request 2: "StrawberryNewtonManicDresser"
  Bank reply 2:     "Okay, you can now use session ID 1234 to request more money."
  
  MITM request 1:   "Gimme $100000."
  Bank reply 1:     "Who are you?"
  MITM request 2:   "Session id 1234."
  Bank reply 2:     "Okay, here's your money."
client certs:

  Client request 1: "Gimme $5."
  Bank reply 1:     "Who are you?"
  
  Client request 2: 
  Bank reply 2:     
  Bank reply 2:     "Okay, you can now use session ID 1234, starting at iteration 2, to request more money."
  
  MITM request 1:   "Gimme $100000."
  Bank reply 1:     "Who are you?"
  MITM request 2:   "Session id 1234, iteration 2."
  Bank reply 2:     
  Bank reply 2:     "You're a faker, get lost."
....at least, I think that's how it works, iirc. The messages are re-signed so a stolen session token doesn't allow replay by an intermediary (the same sort of protection modern TLS has, but for the server's protection, not the client's)

It should be noted that carders, whom normally get their Bank credentials from malware on a user's device, can already inject commands into active valid sessions started by the user, so verifying the user's identity is completely pointless in this case.

Post reply on HN