3 ms·

Pairwise TOTP Authentication of Humans

32 points by transpute 2y ago

coppsilgold 2y ago
This is a decent mitigation. It would be important to mandate that the one initiating the connection has to disclose the code if required (an important ask requiring verification). This seems like it would be obvious, but without being explicit in the protocol there may be some clever social engineering technique to reverse that role. Not following this requirement would allow for a very lenient MITM attack where the attacker can initiate both connections and get one of them to leak the code and use it on the other. Another option would be to have the TOTP code be a custom 10-digit variant (eg. KeePassXC allows this). One party starts with the first 5 digits and the other party must finish it. If this option isn't available, a less ideal one (inconvenient, lower compliance) is to wait for code rollover and have the second party provide the next code. Another problem: A TOTP app is required, in which case why not have an E2E encrypted communication app instead? The only time this is useful is when you cannot have your secure device go online and use the E2E encrypted app and you need to authenticate an unsecured channel on some other device.
gabrielsroka 2y ago
Original post from 9 days ago https://news.ycombinator.com/item?id=42942854 https://news.ycombinator.com/item?id=42942854 Src https://github.com/ksze/PeerAuth https://github.com/ksze/PeerAuth
userbinator 2y ago
How does this differ from traditional asymmetric crypto?
- 8organicbits 2y ago
  Theres no asymmetric crypto here. The QR codes share the same secret. https://github.com/ksze/PeerAuth/blob/main/index.html#L240 https://github.com/ksze/PeerAuth/blob/main/index.html#L240 The big win IMO is that lots of people already have TOTP apps on their phone, so there's nothing extra to install.
  - XorNot 2y ago
    This seems like a weird problem to solve compared to getting people to do this at all. In an age of front facing smart phone cameras I'm at a total loss why no one implements a simple "aim phones and exchange QR codes protocol" for almost everything.
    - 8organicbits 2y ago
      The post is about a simple web page that generates a shared secret which you then aim phones at to collect the QR codes. You could write an app for the same thing, but then you'll need to install (and trust!) a new piece of software.
sureIy 2y ago
FWIW WhatsApp has this builtin, at least at the device level. If you change a device, the other person is notified. If they steal it, unlock it, clone the user's voice before the phone is marked as lost, then yeah still bypassable (but so would be a device-based QR code)
aqueueaqueue 2y ago
> so they can be sure that neither are digital impersonations. They could be human impersonations though: https://xkcd.com/538/ https://xkcd.com/538/ That said the system is decent and require scary threat models to break it! But anyone using this system is already paranoid (not an insult... paranoid can be useful)
noja 2y ago
So wait until authentication is complete and MITM it.
efitz 2y ago
The security in this scenario comes from the fact that the two people met in person. The one-computer solution is a little suspect IMO because it could have exploited some protocol weakness and inserted itself as a MITM. A better solution is probably having Alice and Bob each have an app on their phone that exchanges public keys via QR codes, eg Alice generates a new key pair to talk to Bob with, and the app displayed the public key as a QR code that Bob snaps with his camera in his copy of the app. Then they do it the other way around. I’m pretty sure Signal does (or used to do) something similar. You can have fantastic communications security if you meet in person once and exchange strong authenticators. There are lots of ways to do it; exchange papers with one-time pads on them, etc. But in-person is super inconvenient and is almost universally compromised away.

32 points by transpute 2y ago

This is a decent mitigation. It would be important to mandate that the one initiating the connection has to disclose the code if required (an important ask requiring verification). This seems like it would be obvious, but without being explicit in the protocol there may be some clever social engineering technique to reverse that role. Not following this requirement would allow for a very lenient MITM attack where the attacker can initiate both connections and get one of them to leak the code and use it on the other. Another option would be to have the TOTP code be a custom 10-digit variant (eg. KeePassXC allows this). One party starts with the first 5 digits and the other party must finish it. If this option isn't available, a less ideal one (inconvenient, lower compliance) is to wait for code rollover and have the second party provide the next code. Another problem: A TOTP app is required, in which case why not have an E2E encrypted communication app instead? The only time this is useful is when you cannot have your secure device go online and use the E2E encrypted app and you need to authenticate an unsecured channel on some other device.

gabrielsroka 2y ago

Original post from 9 days ago https://news.ycombinator.com/item?id=42942854 https://news.ycombinator.com/item?id=42942854 Src https://github.com/ksze/PeerAuth https://github.com/ksze/PeerAuth

userbinator 2y ago

How does this differ from traditional asymmetric crypto?

8organicbits 2y ago
Theres no asymmetric crypto here. The QR codes share the same secret. https://github.com/ksze/PeerAuth/blob/main/index.html#L240 https://github.com/ksze/PeerAuth/blob/main/index.html#L240 The big win IMO is that lots of people already have TOTP apps on their phone, so there's nothing extra to install.
- XorNot 2y ago
  This seems like a weird problem to solve compared to getting people to do this at all. In an age of front facing smart phone cameras I'm at a total loss why no one implements a simple "aim phones and exchange QR codes protocol" for almost everything.
  - 8organicbits 2y ago
    The post is about a simple web page that generates a shared secret which you then aim phones at to collect the QR codes. You could write an app for the same thing, but then you'll need to install (and trust!) a new piece of software.

sureIy 2y ago

FWIW WhatsApp has this builtin, at least at the device level. If you change a device, the other person is notified. If they steal it, unlock it, clone the user's voice before the phone is marked as lost, then yeah still bypassable (but so would be a device-based QR code)

aqueueaqueue 2y ago

> so they can be sure that neither are digital impersonations. They could be human impersonations though: https://xkcd.com/538/ https://xkcd.com/538/ That said the system is decent and require scary threat models to break it! But anyone using this system is already paranoid (not an insult... paranoid can be useful)

noja 2y ago

So wait until authentication is complete and MITM it.

efitz 2y ago

The security in this scenario comes from the fact that the two people met in person. The one-computer solution is a little suspect IMO because it could have exploited some protocol weakness and inserted itself as a MITM. A better solution is probably having Alice and Bob each have an app on their phone that exchanges public keys via QR codes, eg Alice generates a new key pair to talk to Bob with, and the app displayed the public key as a QR code that Bob snaps with his camera in his copy of the app. Then they do it the other way around. I’m pretty sure Signal does (or used to do) something similar. You can have fantastic communications security if you meet in person once and exchange strong authenticators. There are lots of ways to do it; exchange papers with one-time pads on them, etc. But in-person is super inconvenient and is almost universally compromised away.