Non-repudiation and the joy of knowing you've been hacked
1–10 of 30 posts
Re: Non-repudiation and the joy of knowing you've been hacked
#2Does obtaining the original Google authenticator QR code actually let you impersonate the authenticator? I was hoping it was a one-time shared secret only used for the authenticator to identify itself to the server for bootstrapping purposes and that a used QR code would be worthless.
Re: Non-repudiation and the joy of knowing you've been hacked
#3The idea that a serious compromise will present a clear path back to a specific ssh key that got used by the attackers and that you'll possibly be able to stop it just by turning off that key is pretty laughable. But then again, so is protecting your core infrastructure with 1.5 factor android soft tokens. Google isn't even willing to make it sound like especially strong protection for your gmail account. How much for a CAC style pki infrastructure? Hard to believe it's more than $50-$100/seat for a small organization. If you're worried about figuring out which employee got his phone dropped after your whole backend got molested perhaps an actual security posture would be more suitable.
Re: Non-repudiation and the joy of knowing you've been hacked
#4Does obtaining the original Google authenticator QR code actually let you impersonate the authenticator? I was hoping it was a one-time shared secret only used for the authenticator to identify itself to the server for bootstrapping purposes and that a used QR code would be worthless.
Yes it does. The QR code just contains the TOTP key and title.
Send it to the email account that will be protected by two-factor authentication using the key, and it won't really matter.
Re: Non-repudiation and the joy of knowing you've been hacked
#5The idea that a serious compromise will present a clear path back to a specific ssh key that got used by the attackers and that you'll possibly be able to stop it just by turning off that key is pretty laughable. But then again, so is protecting your core infrastructure with 1.5 factor android soft tokens. Google isn't even willing to make it sound like especially strong protection for your gmail account. How much fo…
It's by far the most accessible two-factor authentication method, and not as insecure you're making it out to be.
Re: Non-repudiation and the joy of knowing you've been hacked
#6Why do so many people need access to this 'admin' account. Is this an infrastructure problem? I'm struck by the idea the author is discussing how to properly share access to a single account on an OS that was conceived as multiuser.
Re: Non-repudiation and the joy of knowing you've been hacked
#7"if your company uses SSH, chances are you have one Unix Login that all your admins/employees share"
Is that really common? I've never seen it.
Re: Non-repudiation and the joy of knowing you've been hacked
#8"if your company uses SSH, chances are you have one Unix Login that all your admins/employees share" Is that really common? I've never seen it.
[deleted]
Re: Non-repudiation and the joy of knowing you've been hacked
#9"if your company uses SSH, chances are you have one Unix Login that all your admins/employees share" Is that really common? I've never seen it.
Unfortunately not that uncommon.
Re: Non-repudiation and the joy of knowing you've been hacked
#10"if your company uses SSH, chances are you have one Unix Login that all your admins/employees share" Is that really common? I've never seen it.
We released Authy-SSH last september and this was by far the biggest feature request. You will be shockingly surprised if you knew the names of the companies that not only share unix accounts (which is very common) but were actually sharing Two-Factor Authentication keys.