5 ms·

Definitely a cool project. And I agree this is a bad idea in practice for many reasons. But I wasn't aware that TOTP was brute-forcable. What is the mechanism

Definitely a cool project. And I agree this is a bad idea in practice for many reasons. But I wasn't aware that TOTP was brute-forcable. What is the mechanism to achieve this (given only a set of IP address and their timestamps)?

kadoban 5y ago
TOTP implemented this way is brute-forceable because you can just connect to all of the IP addresses (or pick however many connections you can practically make in 60 seconds and hit those). There's no way to lock out after N failures or even to rate limit attempts.
- jacob019 5y ago
  A /80 prefix is equivalent to 65536 ipv4 Internets. Not so brute-forceble.
  - lmz 5y ago
    The random part is six digits. I'd say pretty brute-forceable.
    - AaronFriel 5y ago
      The TOTP spec (rfc6238) allows up to 10 digits or 10 billion unique values, a bit bigger than IPv4's space. Running anything like fail2ban on IP address misses would stop brute forcing in its tracks.
      - kadoban 5y ago
        Both good ideas. None of this fixes even a passive mitm attack, but it's still better.
- yardstick 5y ago
  > There's no way to lock out after N failures or even to rate limit attempts. Given it’s a single machine with a /80, couldn’t the machine rate limit attempts to any IP in the /80? Ie rate limit by source, and separately rate limit by destination. Cover both bases.
  - kadoban 5y ago
    The way I understood it, only the correct IP address would even be connected to anything, the rest would just fail. You probably could do something like that, yeah.
    - yardstick 5y ago
      Good point, just had a look at the code. The NF queue will receive packets from all IPs in the /80 and they are all processed and validated by the ghost program that reads from the queue. So it could do the rate limiting there with full visibility. https://github.com/aidansteele/ipv6-ghost-ship/blob/main/main.go https://github.com/aidansteele/ipv6-ghost-ship/blob/main/mai...

kadoban 5y ago

TOTP implemented this way is brute-forceable because you can just connect to all of the IP addresses (or pick however many connections you can practically make in 60 seconds and hit those). There's no way to lock out after N failures or even to rate limit attempts.

jacob019 5y ago
A /80 prefix is equivalent to 65536 ipv4 Internets. Not so brute-forceble.
- lmz 5y ago
  The random part is six digits. I'd say pretty brute-forceable.
  - AaronFriel 5y ago
    The TOTP spec (rfc6238) allows up to 10 digits or 10 billion unique values, a bit bigger than IPv4's space. Running anything like fail2ban on IP address misses would stop brute forcing in its tracks.
    - kadoban 5y ago
      Both good ideas. None of this fixes even a passive mitm attack, but it's still better.
yardstick 5y ago
> There's no way to lock out after N failures or even to rate limit attempts. Given it’s a single machine with a /80, couldn’t the machine rate limit attempts to any IP in the /80? Ie rate limit by source, and separately rate limit by destination. Cover both bases.
- kadoban 5y ago
  The way I understood it, only the correct IP address would even be connected to anything, the rest would just fail. You probably could do something like that, yeah.
  - yardstick 5y ago
    Good point, just had a look at the code. The NF queue will receive packets from all IPs in the /80 and they are all processed and validated by the ghost program that reads from the queue. So it could do the rate limiting there with full visibility. https://github.com/aidansteele/ipv6-ghost-ship/blob/main/main.go https://github.com/aidansteele/ipv6-ghost-ship/blob/main/mai...