2

Right so I'm developing very private systems recently, and I'm looking into admin login protection. I'm a PHP dev with essential knowledge of js/jq. While I handled most of the stuff so far, I'm looking to protect the login process itself. Now, from what I understand, only internet explorer is allowed to hook into a device (say a CD or a thumb drive) and check for file, only to allow login afterwards, so I'm looking into something that I can actually use. So my idea was a chrome extension, developed internally and unpublished, that would perform something rather complex and thus protect the login page. So I could have a blank login page, or one filled with spammy adds with no login form anywhere, yet by clicking the extension, I'd be able to login.

Also, I'm looking for ideas, not necessarily code, and while I understand it's a generic question, I haven't been able to gather much data on this as the search for "chrome extension protected login" and similar can be quite misleading.

One other thing I found to be cool, but unsure if it's usable, is an NFC tag. In theory, you'd have the website check NFC receiver connected to the PC, if it finds a specific device on top of it, lets you login, otherwise, it doesn't. Just an idea. Considering the environment from which you login is pretty controlled (it's always a PC, always windows, always Chrome, always same country), feel free to hit me with any ideas how would you solve this. Without investing a whole lot of money if possible.

  • 1
    It seems that you want to implement an authentication method that's based on security by obscurity. Have you already tried one of the established, commonly used login methods? If yes, why does it not suit your situation? – Rob W Jan 1 '14 at 20:31
  • @RobW probably, I just learned that it's called that way, thank you for that. What I want to do is use as many methods as I can, but it would be awesome if an extension could do something that a human can't or has very low chances of repeating. Sure, I can say my php is secure, but I can't simply rely on one protection =) So to answer you, I have been using a regular login method (login page with username/password fields), so no, I haven't gone out of that scope yet! – Predrag Beocanin Jan 2 '14 at 0:04
  • You could also put the login page at some hard-to-remember URL, and bookmark it, if you really want to obscure your login page. It should not be needed though. – Rob W Jan 2 '14 at 12:54
  • @RobW hard to explain, but I'm burning a whole lot of time working on the stuff inside the site, I just don't want to worry about other stuff =) How about authenticator system? Extension that generates numbers based on time, cross-references it with same numbers store @ the server and logs user in? Something like that exists? I don't have the knowledge to build a physical device that would do the same at the moment :) – Predrag Beocanin Jan 2 '14 at 16:18
  • 1
    Then a bookmark would be equally effective. Or just restrict website access to a few IP addresses. – Rob W Jan 2 '14 at 17:20
1

After read all the comments of this post (so far), there is no much I can contribute, but thank for sharing. Having said that, here are my opinion about some comments written above.

About the bookmark solution, the problem arise when someone has access to sniffers, proxy or http logs, even browser history of the machine.

I like the idea of @samfisher, use a dynamic token (like the "authenticator" of Google). If you want to submit the secret-value in background (more user friendly) you have to keep the extension away from unwanted people, once the extension is install it on a specific browser, the code is avaliable to that person. Just to use as a reference[1]

Restrict by IP address is always a good idea (work mostly in intranet's or using VPN's

The SSL/TLS solution is what I think you need, in a way, it works as a key, by other, it encrypt the channel. Install once, work everytime (till it expires)

In the majority of the cases, the user machine have to be secure.

PS: You can always accept a specific user-agent http header defined by you to allow incoming connections, some mayor companies had done this in the past[2] ;)

[1] http://blog.valverde.me/2014/01/03/reverse-engineering-my-bank's-security-token/#.U5CvIM9dW24

[2] http://tools.cisco.com/security/center/viewAlert.x?alertId=31348

3

It sounds like you are potentially looking for a physical form of two factor authentication. You may want to look into the YubiKey. It's an easy to add two factor auth to a PHP web app (they even have PHP libraries for you). The keys themselves are very affordable (although I don't know your budget)

If you don't really need a physical device, then definately go with what itscooper suggested. Certificates are totally free, and require pretty much no user interaction (although that can be a downside if the users system isn't secure).

I would have added this as a comment, but I don't have enough 'points'. So silly.


  • Well yeah that would work too, what I was initially looking for is authentication with a file or extension (something you don't have to carry around all the time or something you have on you all the time like a smartphone). Anything that makes it convenient for a small group of administrators to login, is secure, but doesn't require people to go out of their way to stay safe. YubiKey does seem interesting. I'm just looking for a simple way to do stuff, such as identify users based on the Key, and require the key on all pages. Easy to use, easy to clean – Predrag Beocanin Feb 5 '14 at 20:07
  • Well, then either go certificates or use something software based like Google Authenticator (the mobile phone app). You can implement the back end in PHP using code.google.com/p/ga4php – waitingToCompile Feb 5 '14 at 21:20
0

As I understand it, an ideal solution would achieve the following:

  • Protect your application login process by requiring an additional stage of authentication before granting access to the login page (i.e. reducing the likelihood of a brute-force attempt on the username/password etc).
  • Provide an additional factor of authentication (whilst you have not specifically mentioned multifactor, the examples of NFC, USB drives etc pertain to this).

I do not doubt that a well written Chrome extension or similar could potentially achieve this. In order to be an effective form of authentication, it should really be checking for a secret that would only be possessed by a valid admin (I say possessed since we would ideally check for something the user has - we know that the other factor of authentication is a password, something the user knows). There are a number of inherent challenges, including:

  • the generation of a secure key (e.g. a certificate) that is difficult to forge.
  • key management (how will the secret be stored securely?).
  • secure communication with the server (i.e. would it send the whole key or leverage challenge-response? Via what protocol?).
  • the server-side endpoint - if HTTP is used for communication with the server, presumably the server would at some point, or multiple points, need to receive values via parameters. The server-side code here would need to be implemented securely just like the login page itself.

In terms of practicality, a Chrome extension could potentially read a file from disk, although the user would need to select it themselves. http://developer.chrome.com/apps/fileSystem.html

Given the difficulties presented above with regards to implementing this kind of system, I would recommend the age-old and reasonably well-established alternative of SSL/TLS Client Certificates. These would provide an additional factor of authentication (the admin must have a valid certificate) and would otherwise prevent access to the login page entirely (or any HTTP communication for that matter). Furthermore, key generation, management, transport etc are all implemented within the SSL/TLS clients/server, and are comparatively trustworthy given heavy scrutiny from the industry.

An example implementation just to give an idea of what's involved: http://krolm.blogspot.co.uk/2012/09/2-factor-authentication-ssl-client.html

  • Thank you for an extensive answer! Yeah that was the general idea, I want an authentication method that's based on something the user HAS - such as an extension. I can perfectly control the environment where the extension will be, so no worries that it'll leak and expose the login system. However, I have to keep in mind the usability. Security system where you open extension and search for a file is not that great, neither is one where you type in a complex key every time. One where you click the extension and end up logged in, that can be used =) I'm reading on all you linked, thanks again! – Predrag Beocanin Jan 6 '14 at 22:34
  • @SamFisher Regarding SSL/TLS Client Auth, the following article shows how easy it can be to generate and install a certificate for a user with HTML5. Includes a live example to show how it works and the necessary code. Works like a charm in Chrome. scriptjunkie.us/2013/11/… – itscooper Jan 6 '14 at 23:29
  • @SamFisher and once the certificate is installed (whether it's done manually, or via the application), the actual authentication process essentially becomes transparent to the user. They don't have to type or click anything (except a confirmation box I think), the web server just verifies their certificate and they're in! – itscooper Jan 6 '14 at 23:43
  • Yeah it's a good thing from what I can tell. I also had no clue Chrome has acccess to user files, all the systems using some type of "must have connected" auth such as thumb drive or cd had to be ran from IE, if chrome can do that, might not be a bad idea neither. Of course, I'm not going to publish it on the webstore, so I'm not limited by their requirements. =) – Predrag Beocanin Jan 7 '14 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.