Building your own web based Authenticator

Building your own web based Authenticator

• 1.
  Building your ownweb based TOTP
• 2.
  Varun Kondagadapa I’m a: ●Blogger ● Docker superuser! ● Complex gitlab plugins and pipelines ● Python/C# Programmer ● Zerotrust phase 1 ● DevSecOps ● Microsoft fan but use Linux I’m not a: ● Bug hunter ● Malware researcher ● ML guy https://www.reborninfosec.com/
• 3.
  Stop Me! You haveevery right to Stop me!
• 4.
  MFA : MultiFactor Authentication ● Secure from Password stealing attacks ● Sms, App, h/w tokens etc.. ● Compliance requirement i.e eg: PCI DSS ● Implemented independently i.e isolated from actual authentication Little cautious: ● Loss of Tokens, keys, mobile can be problematic
• 5.
  HMAC: Hash basedmessage authentication code ● Keyed-Hashing for Message Authentication ● Hashing with private key ● HMAC = Key + Message + Hash ● Similar to Digital signature but uses symmetric keys ● Hashes can establish integrity but not authenticity ● Issue: Collision-related vulnerabilities of MD5
• 6.
  TOTP : Timebased OTP ● Uses HMAC ● NIST discourages SMS ● Offline sync ● Works with unix time ● Open standard : One can create their own Challenge: ● Keeping the shared key
• 7.
  Authenticator ● Most installedtool for storing otps ● Earlier open source but now proprietary That one drawback: ● What happens when we lose our phone ● No backups
• 8.
  The Project ● Python ●Html ● Google IAP ● Compute Engine ● Sqlite
• 10.
  Conclusion ● Cryptographic techniquesare open to adopt ● An easy way to create our own google authenticator Future Work HMAC for random url generator
• 11.
  References ● https://stackoverflow.com/questions/8529265/google-authenticator-implement ation-in-python ● https://www.jscape.com/blog/what-is-hmac-and-how-does-it-secure-file-transf ers ●https://cloud.google.com/iap/docs/