3 ms·

"could potentially be used to reduce the effectiveness of a current two-factor authentication implementation" What could this be? Initialization settings?

cpswan 16y ago
makes me wonder what they've been holding back from customers and pen testers? Obscurity shouldn't be part of the strength of the solution.
- phrotoma 16y ago
  I've never set one up. There's an RSA encryption cabinet in our datacenter at work, it has red rope around it like a nightclub line and a sign that says no non RSA certified personnel. I imagine anyone who knows what it might be can't confirm what would be useful.
  - jrockway 16y ago
    There's an RSA encryption cabinet in our datacenter at work, it has red rope around it like a nightclub line and a sign that says no non RSA certified personnel. Almost as effective as the ssh banner that says "Unauthorized use is prohibited." Security through hoping people won't step over a rope is no security at all.
    - kgo 16y ago
      Well compared to the ssh banner, it is in a secured data center. All the people in there (hopefully) have been assigned some baseline level of trust. I really hope the story behind that rope is more like: "What the fuck did you do? Every salesman on the East Coast is locked out of the VPN!" "You told me to reboot ALL the servers!" Than some crazy RSA security requirement.
    - runningdogx 16y ago
      It's my understanding that such login banners are used to provide support for prosecution efforts, should someone break in and claim they did not know that access by random people was prohibited. I would hope nobody thinks such warning messages are an adequate substitute for human-based and technology-based security measures, any more than wearing garlic cloves or putting up "no guns allowed" signs are replacements for being wary of vampires and armed criminals.
      - gaius 16y ago
        Yes, there was a case in which a system had "Welcome to XXX" as a banner, and their attempts to prosecute a cracker failed because of this.
        jrockway 16y ago
        That's going to need a citation.
    - phrotoma 16y ago
      I've only been in that datacenter once and I was signed in by someone with authority to help them with something. Like others have said here, it's more to help with "I didn't know I wasn't supposed to touch it" type cases. The RSA cabinet is the security, the rope is legalease.
- biot 16y ago
  I imagine they have a vested interest in obscuring private keys and passphrases.
dekz 16y ago
It depends on what was compromised if anything. There could be a possibility of source code leakage which may have an overlooked implementation flaw. Or there could have been some malicious injection in source, or even tools. If I recall correctly, the "seed" of the tokens are generated at manufacture time and are uploaded to the Token Manager. So it's possible the source was read which could potentially show the method of seed generation, if it's strong that might not be troublesome. I doubt there were any seeds stored along with the source which are then used in production. It's hard to speculate from the lack of information going around.
deleted 16y ago
[deleted]

cpswan 16y ago

makes me wonder what they've been holding back from customers and pen testers? Obscurity shouldn't be part of the strength of the solution.

phrotoma 16y ago
I've never set one up. There's an RSA encryption cabinet in our datacenter at work, it has red rope around it like a nightclub line and a sign that says no non RSA certified personnel. I imagine anyone who knows what it might be can't confirm what would be useful.
- jrockway 16y ago
  There's an RSA encryption cabinet in our datacenter at work, it has red rope around it like a nightclub line and a sign that says no non RSA certified personnel. Almost as effective as the ssh banner that says "Unauthorized use is prohibited." Security through hoping people won't step over a rope is no security at all.
  - kgo 16y ago
    Well compared to the ssh banner, it is in a secured data center. All the people in there (hopefully) have been assigned some baseline level of trust. I really hope the story behind that rope is more like: "What the fuck did you do? Every salesman on the East Coast is locked out of the VPN!" "You told me to reboot ALL the servers!" Than some crazy RSA security requirement.
  - runningdogx 16y ago
    It's my understanding that such login banners are used to provide support for prosecution efforts, should someone break in and claim they did not know that access by random people was prohibited. I would hope nobody thinks such warning messages are an adequate substitute for human-based and technology-based security measures, any more than wearing garlic cloves or putting up "no guns allowed" signs are replacements for being wary of vampires and armed criminals.
    - gaius 16y ago
      Yes, there was a case in which a system had "Welcome to XXX" as a banner, and their attempts to prosecute a cracker failed because of this.
      - jrockway 16y ago
        That's going to need a citation.
  - phrotoma 16y ago
    I've only been in that datacenter once and I was signed in by someone with authority to help them with something. Like others have said here, it's more to help with "I didn't know I wasn't supposed to touch it" type cases. The RSA cabinet is the security, the rope is legalease.
biot 16y ago
I imagine they have a vested interest in obscuring private keys and passphrases.

dekz 16y ago

It depends on what was compromised if anything. There could be a possibility of source code leakage which may have an overlooked implementation flaw. Or there could have been some malicious injection in source, or even tools. If I recall correctly, the "seed" of the tokens are generated at manufacture time and are uploaded to the Token Manager. So it's possible the source was read which could potentially show the method of seed generation, if it's strong that might not be troublesome. I doubt there were any seeds stored along with the source which are then used in production. It's hard to speculate from the lack of information going around.

deleted 16y ago

[deleted]