TOTP implemented this way is brute-forceable because you can just connect to all of the IP addresses (or pick however many connections you can practically make in 60 seconds and hit those).

There's no way to lock out after N failures or even to rate limit attempts.

> There's no way to lock out after N failures or even to rate limit attempts.

Given it’s a single machine with a /80, couldn’t the machine rate limit attempts to any IP in the /80? Ie rate limit by source, and separately rate limit by destination. Cover both bases.

The way I understood it, only the correct IP address would even be connected to anything, the rest would just fail. You probably could do something like that, yeah.

Good point, just had a look at the code. The NF queue will receive packets from all IPs in the /80 and they are all processed and validated by the ghost program that reads from the queue. So it could do the rate limiting there with full visibility.

https://github.com/aidansteele/ipv6-ghost-ship/blob/main/mai...

A /80 prefix is equivalent to 65536 ipv4 Internets. Not so brute-forceble.

The random part is six digits. I'd say pretty brute-forceable.

The TOTP spec (rfc6238) allows up to 10 digits or 10 billion unique values, a bit bigger than IPv4's space.

Running anything like fail2ban on IP address misses would stop brute forcing in its tracks.

Both good ideas.

None of this fixes even a passive mitm attack, but it's still better.