HNHacker News
TopNewBestAskShowJobs

gioazzi

277 karma · joined March 27, 2020

https://github.com/borgoat
submissionscomments
gioazzi··on How to Share a Secret [pdf] (1979)
Yes exactly, that's the idea with that tool, this would make the process compatible with most services (I'd hope, that all services that require this level of attention also offer TOTP).

I believe the sensible next step would then be to implement a mobile authenticator app for this protocol, that can scan QR codes, perform the initial "split", send out the shares, and then orchestrate the generation with other players.

The initial step is the weak link: the user could just store that TOTP secret and everything else becomes pointless. It'd be great to have the service itself (e.g. AWS) generate those shares on their end and send them out individually. But then again, a malicious actor with that kind of access to begin with would have a thousand other ways to do some damage.

gioazzi··on How to Share a Secret [pdf] (1979)
I've been working on something similar to what you described[^1], using Shamir secret sharing to split the TOTP secret. Once enough key holders get together, a server generates some TOTP tokens, but only for a limited period of time.

I wanted to use it in an enterprise environment to limit the access to AWS root users in a break-glass scenario. Now I no longer have such need and haven't developed it further, but the core features are there. As usual though with this kind of tools, any security problem becomes a key management problem and it'd need a bit more work to use it in the real world.

[^1]: https://github.com/borgoat/farmfa

gioazzi··on Maybe Passwords Are the Future
I'd argue that WebAuthn may be classified as transferable? Under the assumption one's using a FIDO security key of course - rather than the platform's built-in authenticator.

I too believe passwords will have their role in the future - although I'd love to see their roles swapped: WebAuthn as first authentication factor - passwords as the optional MFA.

gioazzi··on Ask HN: How can I secure my AWS instance's SSH access if I have no static IP?
+1 - AWS Systems Manager Session Manager [1] is the future! (although it does have a ridiculous name...) It's free, and configuring its agent can enable you to do other useful maintenance tasks through it.

Assuming you're using Amazon Linux 2 as your AMI, it's just as simple as assigning a instance profile with the right permissions (you can use the managed AmazonSSMManagedInstanceCore policy [2]). And you'll then be able to connect through the AWS Console or CLI.

[1]: https://docs.aws.amazon.com/systems-manager/latest/userguide...

[2]: https://console.aws.amazon.com/iam/home#/policies/arn:aws:ia...

gioazzi··on LIVR: Language Independent Validation Rules
https://cuelang.org/ Not entirely the same, but some use cases overlap.
gioazzi··on Quay.io goes down for second time this month
I've been investigating alternatives, and apart from the obvious mirroring images to my {Elastic,Google Cloud,Azure} Container Registry... I found this: https://github.com/miguelmota/ipdr Adding an encryption layer would probably be needed for private images, but overall the idea of using IPFS for container images sounds like a great fit!
← PreviousPage 2 of 2