| |||||||||||||
access to the shared secretaccess to the shared secretPosted Dec 8, 2011 2:50 UTC (Thu) by tialaramex (subscriber, #21167)In reply to: Google Authenticator for multi-factor authentication by dwmw2 Parent article: Google Authenticator for multi-factor authentication
This is way, way, worse than the password case, because the password, even in /etc/passwd days, was stored as a salted CPU-intensive hash. So the bad guys have to do a bunch of heavy lifting (even today it's far from trivial to reverse those old DES based hashes for a decent 8 character password, and if the user upgraded to PHK-MD5 hashes and a 10 character password, kiss your chances goodbye).
But with these OTP systems the stored value is a shared secret. If the bad guy has it, they can successfully authenticate as you with no additional work.
(Log in to post comments)
access to the shared secret Posted Dec 8, 2011 2:58 UTC (Thu) by dwmw2 (subscriber, #2063) [Link] "This is way, way, worse "You are absolutely correct. I do apologise for understating the astounding stupidity of the default Google Authenticator setup.
access to the shared secret Posted Dec 8, 2011 13:50 UTC (Thu) by PlaguedByPenguins (subscriber, #3577) [Link]
how about using google authenticator (or yubikeys etc.) via radius - then you can put all the plaintext secrets on a "secure" radius machine that's heavily defended. no more secrets on clients.
|
|||||||||||||