Mozilla: Improving Security for Bugzilla

Posted Sep 6, 2015 0:43 UTC (Sun) by drag (guest, #31333)
In reply to: Mozilla: Improving Security for Bugzilla by roc
Parent article: Mozilla: Improving Security for Bugzilla

Do you know what software they are using on the phone or server side?

Mozilla: Improving Security for Bugzilla

Posted Sep 6, 2015 7:16 UTC (Sun) by roc (subscriber, #30627) [Link] (4 responses)

On the server side, no.

On the client side, off-the-shelf TOTP apps work, like Google Authenticator on Android.

Mozilla: Improving Security for Bugzilla

Posted Sep 6, 2015 13:14 UTC (Sun) by jhoblitt (subscriber, #77733) [Link] (1 responses)

I stopped using Google Authenticator after loosing a number of TOTP tokens when flashing my phone. I've since switched to a yubikey neo (with NFC) + the yubico equivalent of the Google Authenticator app a couple of months ago.

Mozilla: Improving Security for Bugzilla

Posted Sep 6, 2015 21:11 UTC (Sun) by iarenaza (subscriber, #4812) [Link]

FreeOTP (https://fedorahosted.org/freeotp/) is another alternative.

Mozilla: Improving Security for Bugzilla

Posted Sep 11, 2015 16:12 UTC (Fri) by hkario (subscriber, #94864) [Link] (1 responses)

Google Authenticator is (surprise! surprise!) closed source

hardly a good pick to store your keys to the castle

Mozilla: Improving Security for Bugzilla

Posted Sep 11, 2015 16:20 UTC (Fri) by pizza (subscriber, #46) [Link]

Google Authenticator just implements subsets of an open spec (TOTP, RFC6238) There are many implementations, on a variety of platforms.

Mozilla: Improving Security for Bugzilla

Posted Sep 9, 2015 8:39 UTC (Wed) by ovitters (guest, #27950) [Link]

For server side, seems code is called "MFA". See e.g. http://git.mozilla.org/?p=webtools/bmo/bugzilla.git;a=blob;.... I see the perl module Auth::GoogleAuth as well as GD::Barcode::QRcode for the image. This all is not in an extension.

If you browse around the repository they have all kinds of nice things in extensions. E.g. something which uses a http dns blacklist to automatically deny account creations based on IP address, etc.