epriestley b8cbfda07c Track MFA "challenges" so we can bind challenges to sessions and support SMS and other push MFA ... Summary: Ref T13222. See PHI873. Ref T9770. Currently, we support only TOTP MFA. For some MFA (SMS and "push-to-app"-style MFA) we may need to keep track of MFA details (e.g., the code we SMS'd you). There isn't much support for that yet. We also currently allow free reuse of TOTP responses across sessions and workflows. This hypothetically enables some "spyglass" attacks where you look at someone's phone and type the code in before they do. T9770 discusses this in more detail, but is focused on an attack window starting when the user submits the form. I claim the attack window opens when the TOTP code is shown on their phone, and the window between the code being shown and being submitted is //much// more interesting than the window after it is submitted. To address both of these cases, start tracking MFA "Challenges". These are basically a record that we asked you to give us MFA credentials. For TOTP, the challenge binds a particular timestep to a given session, so an attacker can't look at your phone and type the code into their browser before (or after) you do -- they have a different session. For now, this means that codes are reusable in the same session, but that will be refined in the future. For SMS / push, the "Challenge" would store the code we sent you so we could validate it. This is mostly a step on the way toward one-shot MFA, ad-hoc MFA in comment action stacks, and figuring out what's going on with Duo. Test Plan: - Passed MFA normally. - Passed MFA normally, simultaneously, as two different users. - With two different sessions for the same user: - Opened MFA in A, opened MFA in B. B got a "wait". - Submitted MFA in A. - Clicked "Wait" a bunch in B. - Submitted MFA in B when prompted. - Passed MFA normally, then passed MFA normally again with the same code in the same session. (This change does not prevent code reuse.) Reviewers: amckinley Reviewed By: amckinley Subscribers: PHID-OPKG-gm6ozazyms6q6i22gyam Maniphest Tasks: T13222, T9770 Differential Revision: https://secure.phabricator.com/D19886		2018-12-17 07:00:21 -08:00
..
autopatches	Track MFA "challenges" so we can bind challenges to sessions and support SMS and other push MFA	2018-12-17 07:00:21 -08:00
patches	Upgrade sessions digests to HMAC256, retaining compatibility with old digests	2018-12-13 16:15:38 -08:00
quickstart.sql	Revert quickstart for tables with native FULLTEXT indexes to MyISAM	2017-09-12 12:24:23 -07:00
stopwords.txt	Provide a setup warning about using the default MySQL stopword file	2014-08-13 15:34:09 -07:00
stopwords_myisam.txt	Show users how fulltext search queries are parsed and executed; don't query stopwords or short tokens	2017-04-12 19:07:54 -07:00