Re:Gitlab Critical Security Release
by weird-eye-issue on Saturday February 26, 2022 @11:59AM
(#30479337)
Really? A single if statement is all it would take? More hyperbole from you...
(How do you log used codes, check if a code was previously used, and clean up old used codes in a single if statement?)
Re:Gitlab Critical Security Release
by shaicoleman on Saturday February 26, 2022 @12:07PM
(#30479427)
It already recorded in the database when the TOTP was last used, but it allowed to reuse the same code during the grace period (30 seconds later).
Allowing authentication not only within the original time frame but one interval before and after is by design: https://en.wikipedia.org/wiki/Time-based_one-time_password#S... .
The security issue is with allowing reuse, and not because of allowing use in the previous and next time frames.
* Industrial espionage and state actors - somebody setting up a camera to record the monitor and reusing the token
* Phishing site - the token can be reused, and then redirected to original site. There wouldn't even be an error
* Keylogger
* Somebody logging in while sharing the screen during a Zoom call
* Somebody standing over the shoulder, etc.
Considering this could be prevented with a single if statement, and how important 2FA is in protecting accounts, that's certainly my impression.
The password can be found out through other means, e.g. (password reuse, phishing, keylogger, etc.)
For comparison, the exact same vulnerability was rated as medium severity (5.3/10) - high impact, but difficult to exploit
https://nvd.nist.gov/vuln/detail/CVE-2015-7225