Building your own web based Authenticator
0 likes124 views
This document discusses building your own web-based time-based one-time password (TOTP) authenticator using Python, HTML, Google Identity-Aware Proxy (IAP), Compute Engine, and SQLite. It provides background on multi-factor authentication (MFA) and the cryptographic techniques HMAC and TOTP. The project aims to create an easy way to generate one's own TOTP codes as an alternative to proprietary authenticator apps, while future work could involve using HMAC to generate random URLs.
Building your own web based Authenticator
- 1. Building your own web based TOTP
- 2. Varun Kondagadapa I’m a: ● Blogger ● Docker superuser! ● Complex gitlab plugins and pipelines ● Python/C# Programmer ● Zerotrust phase 1 ● DevSecOps ● Microsoft fan but use Linux I’m not a: ● Bug hunter ● Malware researcher ● ML guy https://www.reborninfosec.com/
- 3. Stop Me! You have every right to Stop me!
- 4. MFA : Multi Factor Authentication ● Secure from Password stealing attacks ● Sms, App, h/w tokens etc.. ● Compliance requirement i.e eg: PCI DSS ● Implemented independently i.e isolated from actual authentication Little cautious: ● Loss of Tokens, keys, mobile can be problematic
- 5. HMAC: Hash based message authentication code ● Keyed-Hashing for Message Authentication ● Hashing with private key ● HMAC = Key + Message + Hash ● Similar to Digital signature but uses symmetric keys ● Hashes can establish integrity but not authenticity ● Issue: Collision-related vulnerabilities of MD5
- 6. TOTP : Time based OTP ● Uses HMAC ● NIST discourages SMS ● Offline sync ● Works with unix time ● Open standard : One can create their own Challenge: ● Keeping the shared key
- 7. Authenticator ● Most installed tool for storing otps ● Earlier open source but now proprietary That one drawback: ● What happens when we lose our phone ● No backups
- 8. The Project ● Python ● Html ● Google IAP ● Compute Engine ● Sqlite
- 10. Conclusion ● Cryptographic techniques are open to adopt ● An easy way to create our own google authenticator Future Work HMAC for random url generator
- 11. References ● https://stackoverflow.com/questions/8529265/google-authenticator-implement ation-in-python ● https://www.jscape.com/blog/what-is-hmac-and-how-does-it-secure-file-transf ers ● https://cloud.google.com/iap/docs/