3

I feel like most of what is written about web security assumes you are using a trusted / secure PC.

I'd like to consider the opposite: you are using a PC (say, at an internet cafe) which is known to be logging keystrokes, and is recording everything displayed in the browser. Let's say you need to access a document on a personal wiki running on your own private server.

I'd like to ask the community what we can achieve here.

Obviously, we are going to have to give up on some things:

  • The attacker will be able to see any documents which you view in the wiki.
  • The attacker will be able to see any edits you make to the wiki.

However, I think we can still achieve limited security:

  • We can prevent the attacker from being able to login to the wiki (after we have left the cafe) and accessing any document they like / performing edits.

This means that what we can accomplish is this: We can access any documents which we don't mind the attacker snooping on (e.g., lasagna recipes), but we can prevent them from performing a login themselves and requesting additional sensitive documents (e.g. financial records).

I think we can accomplish this by using just the 2nd half of 2-factor authentication:

  • The wiki has a special login page from which you can request a one-time-password which is delivered via SMS.

This mechanism is limited as follows:

  • The interface for requesting the one-time-password must not accept arbitrary phone numbers (you enter your username, and the wiki uses the phone number associated with your account).
  • The one-time-password is kept for only one login attempt. If you make a typo, you'll have to request another one-time-password.

This seems to afford the following assurances:

  • If you successfully login, you know that an attacker did not (only one session allowed per one-time-password).
  • If an attacker somehow intercepted the one-time-password and logged in, you'll know, because your login attempt will fail.
  • If your wiki is brute-forced, you'll know (you'll be receiving hundreds of text messages).

I'd love to get some feedback on this idea, especially if there are any glaring holes I've missed!

  • 1
    I think everyone would agree that from an infosec perspective it's always best to assume that nothing is secure; The point would be to minimize the attack surface as much as possible while reasonably accounting for functionality and efficiency. – Jonathan Gray Jan 31 '16 at 1:38
  • If the machine is untrusted, you don't control your input stack, your graphic stack and any of the middleware required to interact with your server and documents. BufferOverflow's answer is spot on, you can't hold the guarantees you want in this scenario. – Steve Dodier-Lazaro Jan 31 '16 at 3:57
  • Just thought I'd point out there is no '2nd half' of 2fa. Two-factor authentication is just that, two factors. Could be any two of something you know, something you have, or something you are. – cremefraiche Jan 31 '16 at 4:03
  • How do you define a "session"? If a session is defined by a session cookie (and maybe tied to the same IP address it was issued to), the attacker can copy that cookie into his own browser session and have the same logged in privileges as you. You'd be safer if retrieving each secure page meant re-authenticating again, but even then, the attacker can view every page you do. – Johnny Jan 31 '16 at 6:50
3

First of all, I would point out that one-time-password is not a replacement for your password, it is a supplementary security feature, in addition to your password.

Second, but most important. You have forgotten that you are using a non-trusted computer. Take the following scenario, you go to Wikipedia and sign in, with your password and one-time-password. The attacker steals your cookies from the computer while you are browsing (remember he has total control over the computer you are using). He then uses the cookie to get access to your account on his computer.

To prevent you from logging out from wiki, he then adds a script to your browser, so when you press logout, it doesn't actually logout, instead it just seems like it.

Wikipedia is a good example sinces it uses end-to-end TLS encryption, there are many more and worse examples, specially in cases where the data is transmitted in cleartext. In such cases, the attacker has also the ability to control your network traffic.

Lets take an example: You sign in to example.com with your password and one-time-password. The attacker (who is in the middle) stops the data packet that contains one-time-password and uses it to sign in on his computer. But he also sends a random one-time-password to the server, so you get an error and have to ask for a new one-time-password.

0

There are a few obvious holes. 1) You need to prevent SMS message spamming from a hostile script hitting that page over and over.

2) How is the one time login, once it's authenticated and removed from your control, prevented from accessing financial data? Remember, the attacker can do at least everything you can do once you've logged in, if not more via exploits.

3) As mentioned, once you've gotten on, the untrusted (hostile) machine has also gotten on, and can then block access from the keyboard/mouse you're at while continuing access from that very machine or another machine with the stolen credentials, maliciously edit every document they can find, attempt SQL Injection and other attacks everywhere they can find, attempt to change your password, phone number on file, email address, and so on and so forth, etc. etc., all the while presenting your own browser on their machine either a generic error message, or what you expect to see.

I think what you actually want is to carry around some device that guarantees that port 2 is solely connected via VPN to your home VPN concentrator/firewall, and then simply use their (hostile) internet access.

Alternately, the same thing, but port 2 only goes to your VPN via Tor, to hide your home server's IP from them (they only see Tor traffic).

  • What is port 2? – Neil Smithline Jan 31 '16 at 17:20
  • Port 2; assuming you have a device with multiple ports, like a Ubiquiti Edgerouter, you'd have Port 1 for WAN and Port 2 that only allows traffic to the VPN and/or VPN over TOR. – Anti-weakpasswords Jan 31 '16 at 22:12
0

You can slightly improve it, if you

  • send request parameter denoting, what you want access http://mypage/lasagna?key=LAS (now you can go only to pages with key=LAS, not FIN)
  • server send you 1time password to your phone (123AGN) - now you know server was asked for lasagna page, not financial
  • you fill given password to page as 456ALA which allows you to edit one page about lasagALAsagna

Now lets supose you do not use plaintext passwrds (LASAGNALASAGNA here, but something else MOUNTEVEREST for example, or better 12$%@2fsw4!@$%, which you have securely written in you pocket. also that reply to 123 is 456 (again rather something more random)

If attacker get in your way, the best he can do is steal the last result and read/edit this one page with lasagna.

More over if you are editing, repeat the procedure with Submit (where the server asks you for some transformation of the edited text as part of the form - (maybe it would show FINGERS and you had fill as answr 5. edited world transformed by something) if the pair does not match for server,then submit does not occure and you are warned by phone, that the account is under attack and will be blocked (maybe after 3. try for 3 hours, or so)

Then the attacker would be not able even save his edits, even if he pretends you valid editing page, as his 5. edited word would be different. (it is depending on the changes made, so it differs for your and attackers edit)

Again every security prompt/answer are encoded by some your pocket paper list.

Now you just need to have the pocket paper random enought and hidden from attacker and he would be able to read over your shoulder, cancel you edits, but nothing more. Especially not access FINANCIAL pages, as you do not even open your pocket book on page for financial, which is different.

  • This seems very complicated and hence error prone. Would it be easier to have a second, low privileged account that you use? – Neil Smithline Jan 31 '16 at 17:23
  • That is right that using account with less privileges is always recomended. But still it can be inconvenient create account for each and every page you want have accessible from wild. And when author expect to setup sendind one-time passwords via SMS as premise, then reading 4 words from booklet is not much work over – gilhad Feb 1 '16 at 12:48
0

Most sites will ask for you to input your password again if you're changing settings precisely because the sites know if your cookies have been stolen, then low grade activities can be snooped on. On the other hand, changing passwords would have a time crtitical cookie used. Think about when this change happened in web development. 2004-5?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.