31–40 of 200 posts
Really cool idea. If someone is interested further in the general concept it is called ”moving target defense.”
Compared to just deploying totp normally as a PAM module this is a horrible idea. Much harder to ratelimit, much cheaper for the attacker to bruteforce codes. It’s neat for sure, but not a good defense.
And all you have to do is trust that your client and server will always have synchronized clocks...
... like you need to when using TOTP for anything
I'd almost rather a combined thing where it's HOTP but it also rotates once per day like at midnight? Does anything do that, or does it even make sense? Is there a reasonable alternative -- challenge-response maybe?
Really cool idea. If someone is interested further in the general concept it is called ”moving target defense.”
You should never intentionally do it to your own systems. If you see something like this deployed assume it's either malice or laziness.
Earlier quoted context omitted.
Layering has additional costs, like requiring additional client configuration and software and (in this case) only working over IPv6. The number one step any public‐facing SSH server should take is to switch from password auth to keys only. Anyone who’s still concerned can put it behind a WireGuard VPN. Layers typically added beyond that (like changing port, etc.) don’t even register on the security scale, so to spea…
The simple fact that ssh is over IPv6 already leaves out 99% of potential hackers aka bots.
I wonder if there's a "missed opportunity" for hackers there given presumably how many forget to configure their IPv6 firewall.
Make sure your time servers are configured correctly. My department had several Silicon Graphics workstations. Running IRIX, they machines determine amongst themselves which has the most accurate time and they vote that one as the Timemaster. Any new machines added would take their time from the Timemaster. The oldest machine was Timemaster and 8.5 minutes off. Took me week to figure out why my brand workstation had…
This makes me wonder if you could take this further and make the connection protocol dance across a variety of ports as part of the initial handshake.
Make sure your time servers are configured correctly. My department had several Silicon Graphics workstations. Running IRIX, they machines determine amongst themselves which has the most accurate time and they vote that one as the Timemaster. Any new machines added would take their time from the Timemaster. The oldest machine was Timemaster and 8.5 minutes off. Took me week to figure out why my brand workstation had…
Man. Time based bugs are some of the worst. I spent weeks trying to figure out what was wrong with some of my scripts running under WSL. Apparently wsl Linux kernel had a bug that could cause time to drift by minutes.