5 ms·

no, it has nothing to do with a “stupid” law, it seems to me the article is misleading. It has to do with being a trusted source of identity information and fsc

no, it has nothing to do with a “stupid” law, it seems to me the article is misleading. It has to do with being a trusted source of identity information and fscking up very thoroughly: The university of Giessen is providing it’s members identity services for the DFN Network (German Research Network) with a high degree of reliance called _advanced_. This degree requires that „for identification, users must present themselves in person with an official ID. The enrolment and recruitment procedures established by the universities are considered as equivalent.“ ( see https://doku.tid.dfn.de/en:degrees_of_reliance https://doku.tid.dfn.de/en:degrees_of_reliance ) It seems to me that this university’s services are a very interesting target.

imInGoodCompany 7y ago
What you write is true, but generally the support and use of electronic identification in Germany is very poor, partially a result of complex and (at times) overly restrictive legislation. Especially compared to the Nordic countries where people use some sort of eID for practically everything. I have no stats on hand for this, but my work is in developing integrations towards major eID providers in Europe.
- Tomte 7y ago
  I've had an Estonian e-Residency card. I had to pick it up at an Estonian police station and show my official government ID. I don't see why a German university demanding the same for a comparable cryptographic certificate is bad.
  - ga-vu 7y ago
    It's not a "a comparable cryptographic certificate" It's just a plaintext password
    - Tomte 7y ago
      The student id card has a comparable certificate on it, as far as I understand it.
angry_octet 7y ago
Given the inevitable slow and steady loss of such credentials to adversaries, it seems like they need more than a single factor. Like, a backup password (on paper) that can be used to reset the account password, or similarly a TOTP seed (2D barcode). Otherwise rolling passwords becomes incredibly expensive. I'm almost surprised they haven't gone the same route as Estonia, but there are lots of federated systems so it might just be inertia.
- Tomte 7y ago
  I love what Estonia is doing, but we need to keep in mind that (a) Estonia is a very young country, so they could start from scratch (b) Estonia has very few citizens. At a guided tour in Tallinn the guide said that many of us came from cities more populous than their country. :-) (c) Estonia is more... adventurous in some regards. They have a National DNA Database, for example. Try selling that in the country of the Gestapo and the Stasi. (d) But first and foremost, it is great that there is a smallish country experimenting with all kinds of new stuff. The rest of Europe will benefit a lot, just by watching them and picking some of the things they already implemented and tested.
  - angry_octet 7y ago
    I ought to have googled! Of course they have an electronic ID card project, they have just been testing it from 2006-2010 and slowly issuing it since 2010 with 'turn on' in 2017 with a goal of 2020. The Gemalto overview is fantastic: https://www.gemalto.com/govt/inspired/eid-in-germany https://www.gemalto.com/govt/inspired/eid-in-germany https://www.bsi.bund.de/EN/Topics/ElectrIDDocuments/German-eID/german-eID_node.html https://www.bsi.bund.de/EN/Topics/ElectrIDDocuments/German-e... Edit: trying to submit the Gemalto Dec 2019 update as a new story but I seem to be banned from submitting stories. Merry xmas HN.
0b0001 7y ago
The university website mentions student ID cards with chip. Is that not sufficient to provide strong authentication towards a self-service portal for password reset?
- ashildr 7y ago
  We have no real information on the systems targeted or the vector(s), so it’s possible that JLU is currently carefully running a black start scenario. It is possible that even if the ID cards or something else could be used as a factor, what we don’t know, systems or certificates vouching for the student ID cards are now considered not trusted. This now seems like a painful but responsible way to hand out new credentials. While a lot more information would be interesting, I gather the sysadmins involved have to priotitize as they are right now. I hope that there will be an interesting post mortem, though.
- datenwolf 7y ago
  > The university website mentions student ID cards with chip. Is that not sufficient to provide strong authentication towards a self-service portal for password reset? In theory it should be sufficient. In practice there is very little awareness of the capabilities of these smartcards and that they could, in theory, be used as a 2FA token. These cards are mostly used for physical access control, library pass and cafeteria payment. There's left a lot to be desired in most (german) university networks. Yes, there is usually some sort of Radius and 801.1X infrastructure in place, but it's only used for WiFi login and eduroam, not for machines plugged into wall sockets. Yes, there usually is some sort of Active Directory and/or Kerberos infrastructure in place (yes, I am aware that AD is essentially LDAP + Kerberos), but it's often used only for the student computer pools, but not office workstations. There seems to be zero awareness, that if you have AD and/or Kerberos authentication working in place (one can only dream of it being coupled to the student / staff smartcards), you can use it GSSAPI for web single sign-on which would instantly neuter any attempts of phishing. Also you will still often find the preconception of there being such a thing as a "secure network" and an "insecure, hostile" internet. The notion of lateral movement and treating every network segment as insecure, no matter where or how it's managed in your org, is more or less nonexisting.
ga-vu 7y ago
It's a university email, not Pentagon backend accounts. It is a stupid law because they're being way too thorough and abrasive when they shouldn't. How much do you wanna bet the German parliament is not protected in the same way... actually don't answer that... here's an article published today about a stupid vulnerability in the Bundestag's internal chat app: https://zero.bs/osintrecon-vs-pentestschwachstellenscan.html https://zero.bs/osintrecon-vs-pentestschwachstellenscan.html
- kaybe 7y ago
  Depending on the permissions on the accounts they can be pretty powerful. Not just access to eduroam (which all of them have and which is extremely convenient) and full course records including results (also from teacher side!) but also access to many resources such as supercomputer clusters, scientific literature behind paywalls, software licenses (also for expensive things) and many more. Note that institutions such as ESA, CERN or the local space agencies are also involved in the network. There absolutely are very interesting targets, even if you are a state actor.

imInGoodCompany 7y ago

What you write is true, but generally the support and use of electronic identification in Germany is very poor, partially a result of complex and (at times) overly restrictive legislation. Especially compared to the Nordic countries where people use some sort of eID for practically everything. I have no stats on hand for this, but my work is in developing integrations towards major eID providers in Europe.

Tomte 7y ago
I've had an Estonian e-Residency card. I had to pick it up at an Estonian police station and show my official government ID. I don't see why a German university demanding the same for a comparable cryptographic certificate is bad.
- ga-vu 7y ago
  It's not a "a comparable cryptographic certificate" It's just a plaintext password
  - Tomte 7y ago
    The student id card has a comparable certificate on it, as far as I understand it.

angry_octet 7y ago

Given the inevitable slow and steady loss of such credentials to adversaries, it seems like they need more than a single factor. Like, a backup password (on paper) that can be used to reset the account password, or similarly a TOTP seed (2D barcode). Otherwise rolling passwords becomes incredibly expensive. I'm almost surprised they haven't gone the same route as Estonia, but there are lots of federated systems so it might just be inertia.

Tomte 7y ago
I love what Estonia is doing, but we need to keep in mind that (a) Estonia is a very young country, so they could start from scratch (b) Estonia has very few citizens. At a guided tour in Tallinn the guide said that many of us came from cities more populous than their country. :-) (c) Estonia is more... adventurous in some regards. They have a National DNA Database, for example. Try selling that in the country of the Gestapo and the Stasi. (d) But first and foremost, it is great that there is a smallish country experimenting with all kinds of new stuff. The rest of Europe will benefit a lot, just by watching them and picking some of the things they already implemented and tested.
- angry_octet 7y ago
  I ought to have googled! Of course they have an electronic ID card project, they have just been testing it from 2006-2010 and slowly issuing it since 2010 with 'turn on' in 2017 with a goal of 2020. The Gemalto overview is fantastic: https://www.gemalto.com/govt/inspired/eid-in-germany https://www.gemalto.com/govt/inspired/eid-in-germany https://www.bsi.bund.de/EN/Topics/ElectrIDDocuments/German-eID/german-eID_node.html https://www.bsi.bund.de/EN/Topics/ElectrIDDocuments/German-e... Edit: trying to submit the Gemalto Dec 2019 update as a new story but I seem to be banned from submitting stories. Merry xmas HN.

0b0001 7y ago

The university website mentions student ID cards with chip. Is that not sufficient to provide strong authentication towards a self-service portal for password reset?

ashildr 7y ago
We have no real information on the systems targeted or the vector(s), so it’s possible that JLU is currently carefully running a black start scenario. It is possible that even if the ID cards or something else could be used as a factor, what we don’t know, systems or certificates vouching for the student ID cards are now considered not trusted. This now seems like a painful but responsible way to hand out new credentials. While a lot more information would be interesting, I gather the sysadmins involved have to priotitize as they are right now. I hope that there will be an interesting post mortem, though.
datenwolf 7y ago
> The university website mentions student ID cards with chip. Is that not sufficient to provide strong authentication towards a self-service portal for password reset? In theory it should be sufficient. In practice there is very little awareness of the capabilities of these smartcards and that they could, in theory, be used as a 2FA token. These cards are mostly used for physical access control, library pass and cafeteria payment. There's left a lot to be desired in most (german) university networks. Yes, there is usually some sort of Radius and 801.1X infrastructure in place, but it's only used for WiFi login and eduroam, not for machines plugged into wall sockets. Yes, there usually is some sort of Active Directory and/or Kerberos infrastructure in place (yes, I am aware that AD is essentially LDAP + Kerberos), but it's often used only for the student computer pools, but not office workstations. There seems to be zero awareness, that if you have AD and/or Kerberos authentication working in place (one can only dream of it being coupled to the student / staff smartcards), you can use it GSSAPI for web single sign-on which would instantly neuter any attempts of phishing. Also you will still often find the preconception of there being such a thing as a "secure network" and an "insecure, hostile" internet. The notion of lateral movement and treating every network segment as insecure, no matter where or how it's managed in your org, is more or less nonexisting.

ga-vu 7y ago

It's a university email, not Pentagon backend accounts. It is a stupid law because they're being way too thorough and abrasive when they shouldn't. How much do you wanna bet the German parliament is not protected in the same way... actually don't answer that... here's an article published today about a stupid vulnerability in the Bundestag's internal chat app: https://zero.bs/osintrecon-vs-pentestschwachstellenscan.html https://zero.bs/osintrecon-vs-pentestschwachstellenscan.html

kaybe 7y ago
Depending on the permissions on the accounts they can be pretty powerful. Not just access to eduroam (which all of them have and which is extremely convenient) and full course records including results (also from teacher side!) but also access to many resources such as supercomputer clusters, scientific literature behind paywalls, software licenses (also for expensive things) and many more. Note that institutions such as ESA, CERN or the local space agencies are also involved in the network. There absolutely are very interesting targets, even if you are a state actor.