@mjg59@nondeterministic.computer
@mjg59@nondeterministic.computer avatar

mjg59

@mjg59@nondeterministic.computer

Former biologist. Actual PhD in genetics. Security at https://aurora.tech, OS security teaching at https://www.ischool.berkeley.edu. Blog: https://mjg59.dreamwidth.org. He/him.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

mjg59, to random
@mjg59@nondeterministic.computer avatar

I am, once again, attempting to figure out how the fuck Okta's API actually works

mjg59, to random
@mjg59@nondeterministic.computer avatar

Refactor code to allow me to call login method from other contexts
Wonder why I'm getting invalid session errors
Realise I'm no longer actually calling the login method

mjg59, to random
@mjg59@nondeterministic.computer avatar

Well shit I apparently need to write about agent forwarding

mjg59, to random
@mjg59@nondeterministic.computer avatar

One of the problems here is that the SSH agent protocol doesn't include the host that's being authenticated to in the request. In theory we could implement an SSH agent that popped up a request asking you to agree to the request before signing - but it has no way of knowing who it's signing on behalf of, because the protocol doesn't include the destination

mjg59,
@mjg59@nondeterministic.computer avatar

Ideally you'd be able to get a prompt saying "evil.com wants your ssh key" and you'd say no, and also if a site says "cats.com wants your ssh key" and then tries to use that to access dogs.com dogs.com would see that the signature was for cats.com, but the protocol doesn't seem to allow this

mjg59,
@mjg59@nondeterministic.computer avatar

I unironically love the SSH agent protocol and I have done some terrible things with it at a professional level but I think given what we know now this is now what it would look like if developed again

mjg59,
@mjg59@nondeterministic.computer avatar

@azonenberg You're still trusting the remote system to forward to the correct host and for you to notice the key mismatch

mjg59,
@mjg59@nondeterministic.computer avatar

@azonenberg (I agree that this is easier)

mjg59,
@mjg59@nondeterministic.computer avatar

@jmc someone who has root on the remote server can just fake all of that

mjg59, (edited ) to random
@mjg59@nondeterministic.computer avatar

I'm sure this is general knowledge but anyway: never enable SSH agent forwarding by default if you log into any systems that you don't trust 100%. It gives whoever has root on that system the ability to log into anything else your SSH agent can connect to. Either explicitly pass -A or add host entries to ~/.ssh/ssh_config to enable it for the scenarios you need it.

mjg59,
@mjg59@nondeterministic.computer avatar

For context: when you log into a remote site using an SSH key, the remote site sends a challenge and you sign that challenge with your private key and send the signature back. The remote site verifies that and if it matches the public key that's in authorized_keys, it lets you log in.

mjg59,
@mjg59@nondeterministic.computer avatar

If you forward your agent to a remote system, ssh on the remote system can ask your local agent to sign a challenge so you can log into a further remote system. But that also means anyone on the remote system who can impersonate you can also ask your local agent to sign whatever challenges they want, which means they can then log into any systems you have key-based authentication to

mjg59,
@mjg59@nondeterministic.computer avatar

So you forward your agent to A so you can log into B. Someone who has root on A can now ask your agent to sign a challenge for any system that you can log into using keys that are in your agent

mjg59,
@mjg59@nondeterministic.computer avatar

So eg for the love of god do not enable agent forwarding for github.com because anyone who compromises github.com can then log into any site your keys have access to

mjg59, to random
@mjg59@nondeterministic.computer avatar

An inevitable consequence of owning https://eicar-test-file.zip is that people will actually use it which is great because then I can just put something that isn't the canonical test file there and all their tests will break

mjg59, to random
@mjg59@nondeterministic.computer avatar

For no obvious reason whatsoever, AmiTCP (a third party port port of the BSD IP stack to AmigaOS that was used a bunch) enabled the chargen service (a service that just sends printable ASCII characters as fast as possible) and had no firewall so back in the 90s you could just DoS Amiga users by connecting to port 19 on their machine and they'd saturate their uplink and ping out of IRC and not everything in the past was better

mjg59,
@mjg59@nondeterministic.computer avatar

@larsmb Fucking Hayes guard time patent

mjg59,
@mjg59@nondeterministic.computer avatar

@mrgtwentythree Yeah but it wasn't like that was a naturally inherited thing, someone had to actually make the decision to port that over

mjg59,
@mjg59@nondeterministic.computer avatar

@mrgtwentythree They added a GUI for managing inetd services, it's just weird to do that and not think "Huh should this really be on by default"

mjg59,
@mjg59@nondeterministic.computer avatar

@flohoff Thankfully I managed to miss SLIP and only had to deal with PPP, but even so the hardware buffer size in the CIAs was really not fit for purpose

mjg59,
@mjg59@nondeterministic.computer avatar

@flohoff (I first got online with an A3500, which was the prototype for the A3000T - it's still under my desk, running Amiga Unix, and I'm in the process of writing a full ZZ9000 driver for it)

mjg59,
@mjg59@nondeterministic.computer avatar

@tiaz Look as long as I'm the person who gets to make that decision then everything's fine but if we let anyone else do it then everything will just go to shit

mjg59,
@mjg59@nondeterministic.computer avatar

@mrgtwentythree Well fuck

mjg59,
@mjg59@nondeterministic.computer avatar

@isotopp @larsmb No but I do own https://eicar-test-file.zip

mjg59, to random
@mjg59@nondeterministic.computer avatar

Why does sha256sum on my phone handle an 8GB file in 11 seconds and sha256sum on my laptop takes 17 seconds to do the same file? Hot cache in both cases, Pixel 7 (8GB of RAM) vs a i7-10510U with a Samsung 980 NVMe and 32GB of RAM on the laptop. Is Toybox's implementation better, or is Tensor just genuinely fast? Is UFS somehow faster than NVMe?

mjg59,
@mjg59@nondeterministic.computer avatar

@ross openssl gives similar results on the laptop

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • JUstTest
  • tacticalgear
  • DreamBathrooms
  • InstantRegret
  • magazineikmin
  • Youngstown
  • everett
  • anitta
  • slotface
  • GTA5RPClips
  • rosin
  • thenastyranch
  • kavyap
  • mdbf
  • Leos
  • modclub
  • osvaldo12
  • Durango
  • khanakhh
  • provamag3
  • cisconetworking
  • ngwrru68w68
  • cubers
  • tester
  • ethstaker
  • megavids
  • normalnudes
  • lostlight
  • All magazines
    •