Does anyone know the last Thunderbird nightly build that's okay to use if you don't want all your extensions to be disabled?
Thunderbird 60.0 release
51–57 of 57 posts
Re: Thunderbird 60.0 release
#52Earlier quoted context omitted.
> One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over. This is, again, wrong. Guessing a 6-digit number will take, on average, 500,000 tries; if the answer changes with each guess, it will take only twice as much (same as when picking random guesses instead of iterating throug…
I don't think you've understood what has to be guessed. It's not the OTP alone; it's the OTP and the password, together. If the OTP "000000" is correct with 50% probability after 500,000 attempts, you've just increased the number of attacks necessary to brute-force a password against a live server by (conservatively) 50,000,000%.
Sorry, that part I understood. Your comment said something else. There are no moving goalposts, at least not in a way that matters.
Re: Thunderbird 60.0 release
#53Earlier quoted context omitted.
I don't think you've understood what has to be guessed. It's not the OTP alone; it's the OTP and the password, together. If the OTP "000000" is correct with 50% probability after 500,000 attempts, you've just increased the number of attacks necessary to brute-force a password against a live server by (conservatively) 50,000,000%.
Sorry, that part I understood. Your comment said something else. There are no moving goalposts, at least not in a way that matters.
If you are attempting a brute force attack against a particular password, you either need to know a single OTP and complete the attack before it changes ("the goalposts move"), or try every password with every possible OTP, or compromise the OTP secret.
Re: Thunderbird 60.0 release
#54Earlier quoted context omitted.
Sorry, that part I understood. Your comment said something else. There are no moving goalposts, at least not in a way that matters.
If you are attempting a brute force attack against a particular password, you either need to know a single OTP and complete the attack before it changes ("the goalposts move"), or try every password with every possible OTP, or compromise the OTP secret.
Yes, that's the part that's wrong/misleading (or at least one interpretation of it). See my earlier comment.
Re: Thunderbird 60.0 release
#55Earlier quoted context omitted.
If you are attempting a brute force attack against a particular password, you either need to know a single OTP and complete the attack before it changes ("the goalposts move"), or try every password with every possible OTP, or compromise the OTP secret.
Yes, that's the part that's wrong/misleading (or at least one interpretation of it). See my earlier comment.
Let's describe the attack in detail.
You know:
- A username
In order to gain access to this system, you must supply:
- A username - The corresponding password - A TOTP code valid for the time you make the attempt
If any piece of information you give the server is wrong, you get an "auth failed" message which reveals nothing about which part(s) you got wrong. It is an oracle which answers only "yes" or "no".
Assuming you can guess (ask the oracle) once per second, that there are 52^8 possible passwords and 10^6 possible OTPs, and that every thirty seconds the valid OTP shifts to a new totally random value within the valid range, estimate the number of guesses necessary to find (with 50% probability) the correct combination of information. Now repeat the exercise, with the changed situational parameter that you no longer need to supply a correct TOTP.
I think you will find that the estimated time to crack is increased by much, much, much more than a factor of two by having the OTP. I would be interested to see any alternate answer and the reasoning behind the same.
Re: Thunderbird 60.0 release
#56Earlier quoted context omitted.
Yes, that's the part that's wrong/misleading (or at least one interpretation of it). See my earlier comment.
Let's describe the attack in detail. You know: - A username In order to gain access to this system, you must supply: - A username - The corresponding password - A TOTP code valid for the time you make the attempt If any piece of information you give the server is wrong, you get an "auth failed" message which reveals nothing about which part(s) you got wrong. It is an oracle which answers only "yes" or "no". Assuming…
[deleted]
Re: Thunderbird 60.0 release
#57Earlier quoted context omitted.
Yes, that's the part that's wrong/misleading (or at least one interpretation of it). See my earlier comment.
Let's describe the attack in detail. You know: - A username In order to gain access to this system, you must supply: - A username - The corresponding password - A TOTP code valid for the time you make the attempt If any piece of information you give the server is wrong, you get an "auth failed" message which reveals nothing about which part(s) you got wrong. It is an oracle which answers only "yes" or "no". Assuming…
Assuming the attacker has neither the password nor the OTP seed and must brute-force both (which is what 2FA is all about), the OTP doesn't add more security than the bits it has (about 20 for a 6-digit decimal number), plus the 1 bit because it's not constant. For this reason, I think it's misleading to say that there are moving goalposts or such. Neither the entire attack nor any part of it must be completed within 30 seconds or whatever the refresh interval is of the OTP token. Cracking both is still a classic brute-force attack.