News for hackers. Stuff that matters.

A comment on Gitlab Critical Security Release. Parent comment

Re:Gitlab Critical Security Release by weird-eye-issue on Saturday February 26, 2022 @11:59AM (#30479337)
Really? A single if statement is all it would take? More hyperbole from you...

(How do you log used codes, check if a code was previously used, and clean up old used codes in a single if statement?)

[ Parent | on HN ]
Re:Gitlab Critical Security Release by shaicoleman on Saturday February 26, 2022 @12:07PM (#30479427)
It already recorded in the database when the TOTP was last used, but it allowed to reuse the same code during the grace period (30 seconds later).
[ Parent | on HN ]
Re:Gitlab Critical Security Release by diarrhea on Saturday February 26, 2022 @02:32PM (#30480975)
Allowing authentication not only within the original time frame but one interval before and after is by design: https://en.wikipedia.org/wiki/Time-based_one-time_password#S... .
[ Parent | on HN ]
Re:Gitlab Critical Security Release by prplr on Saturday February 26, 2022 @02:57PM (#30481214)
The security issue is with allowing reuse, and not because of allowing use in the previous and next time frames.
[ Parent | on HN ]
Re:Gitlab Critical Security Release by trillic on Saturday February 26, 2022 @12:05PM (#30479399)
Not OP, but yes really.

Check the last login/session/whatever for that account and if it was within the period of the TOTP that was submitted, force a relog.

[ Parent | on HN ]