3 ms·
There can be several threat models: * Industrial espionage and state actors - somebody setting up a camera to record the monitor and reusing the token * Phish
by shaicoleman 5y ago
There can be several threat models:
* Industrial espionage and state actors - somebody setting up a camera to record the monitor and reusing the token
* Phishing site - the token can be reused, and then redirected to original site. There wouldn't even be an error
* Keylogger
* Somebody logging in while sharing the screen during a Zoom call
* Somebody standing over the shoulder, etc.
Considering this could be prevented with a single if statement, and how important 2FA is in protecting accounts, that's certainly my impression.
The password can be found out through other means, e.g. (password reuse, phishing, keylogger, etc.)
For comparison, the exact same vulnerability was rated as medium severity (5.3/10) - high impact, but difficult to exploit
https://nvd.nist.gov/vuln/detail/CVE-2015-7225 https://nvd.nist.gov/vuln/detail/CVE-2015-7225
- weird-eye-issue 5y agoReally? A single if statement is all it would take? More hyperbole from you... (How do you log used codes, check if a code was previously used, and clean up old used codes in a single if statement?)
- trillic 5y agoNot OP, but yes really. Check the last login/session/whatever for that account and if it was within the period of the TOTP that was submitted, force a relog.
- shaicoleman 5y agoIt already recorded in the database when the TOTP was last used, but it allowed to reuse the same code during the grace period (30 seconds later).
- diarrhea 5y agoAllowing authentication not only within the original time frame but one interval before and after is by design: https://en.wikipedia.org/wiki/Time-based_one-time_password#Security https://en.wikipedia.org/wiki/Time-based_one-time_password#S... .
- prplr 5y agoThe security issue is with allowing reuse, and not because of allowing use in the previous and next time frames.