A complete bypass of eMudhra’s 1FA OTP login system (mastodon.catgirl.cloud)

so not sure why the author shows us the public key

That has no effect, since the'd get no such business from now.

What's sad it they won't be taking their certs with them. Let's hope the powers up the chain conduct some deep self-refection on their part in thus fiasco.

Only if they're lazy and went with the "download key and certificate (and we'll generate the keys for you)" option. Otherwise at least how it's supposed to work is that you give a CA a certificate signing request (CSR) containing your public key, they sign it and hand back your certificate. The certificate itself doesn't contain anything sensitive, because it's the same thing that your server presents to clients. But people are lazy and might not know how to generate a csr locally, hence the aforementioned option. And of course if they're too lazy to generate a csr locally, they're probably also too lazy to keep backups, so you can be sure that eMudhra keeps a copy in case they deleted it from their downloads folder.

I noticed that as well. Figured it was a concurrency issue, and they have a follow-up message that you can see if you click on the OP of the Mastodon thread that confirmed my guess: https://mastodon.catgirl.cloud/@49016/117476097901925573

>(yes the code is off by a few. its bc the poc is shit and to speed it up it uses 8 connections at the same time. it just stops the counter once it has a hit so its off by ~4 lmfao. you could easily fix this but cba today)

You can use https://github.com/jwilk/zygolophodon to read Mastodon posts in your terminal:

  $ zygolophodon --with-ancestors https://mastodon.catgirl.cloud/@49016/117475976434068995

Ah yes, adopting the standard cloudflare approach. "Contact the site administrator to resolve this" but no contact details are provided.

Aye, but it'll now represent much, much more than 1% of their corporate reputation.

Purported security, you mean.

Actual security, add some zeros ;)

I guess they just bruteforce OTP by sending all combinations of four digits to the server and eventually one works.

Yes, it’s a complete auth bypass. All you need is the email address of a user and they’ll likely sign CSRs for any domains under that account.

It’s the end for them, I imagine.

It worked for me just now, and I'm on mobile internet which gets blocked more often than landline connections.

If anyone can guess or brute force the factor, it's approaching 0FA.

It's like fractals, not all dimensions are integers. If your one factor is extremely weak, then it's really only 0.x of a factor.

That was proof of soul check and you passed

that's actually the exploit, it was very physical

That's what comes after the verification can.

anti-AI scraping is often anti-privacy in practice, as any effective implementation requires invasive browser inspection to detect scrapers.

I got the same, on a residential internet service. No idea what the trigger is, worked on my phone though.

I gave up cell phone service a few years ago (mid-sized USA city).

This seems less-and-less extreme, daily. Free yourselves from your leashes!

----

Next time you're standing in line, strike up conversation (about anything) with your ugliest linemate (it doesn't even matter about what, just offline communication)...

Maybe ya'll both like ZFS or "heard about that PHP thing!?" (I used both conversation starters, today – it worked – I can be the ugliest, too).