I've been testing the 2FA module in our install, working great so far, but I noticed the authentication form field is not marked to be excluded from auto completion. Because of this, after several weeks of use, every time I click on the field, I see a list of all prior authentication codes used. This might be possible to be used in an attack to reverse-engineer the secret key using past codes and when they were entered. Even if that isn't the case, it means browsers are saving loads of unnecessary data that is one-time use. Information on how to disable auto completion in form fields can be found here: https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
Created attachment 149725 [details] [review] Bug 33253: Turn off autocompletion for 2FA authentication code The form for entering your authentication code shoudl not suggest previous codes. To test: * Activate TwoFactorAuthentication * Go to your patron account in staff * More > Manage 2-factor authentication * I used "Google authenticator" on my phone, so: * Open app on your phone, add new and scan the QR code * Enter activation code * Log out of staff interface * Log back in, you are now also asked for an authentication code as second step * Look up code in app, enter, get logged in * Log out, log back in - the form now suggests the previous code when you click on it * Apply patch * Reload things (restart_all on ktd) * Verify that you no longer get the suggestion
Thx for filing Sam! Maybe you want to test? It should work on the sandboxes too: https://wiki.koha-community.org/wiki/Sandboxes
Created attachment 149733 [details] [review] Bug 33253: Turn off autocompletion for 2FA authentication code The form for entering your authentication code shoudl not suggest previous codes. To test: * Activate TwoFactorAuthentication * Go to your patron account in staff * More > Manage 2-factor authentication * I used "Google authenticator" on my phone, so: * Open app on your phone, add new and scan the QR code * Enter activation code * Log out of staff interface * Log back in, you are now also asked for an authentication code as second step * Look up code in app, enter, get logged in * Log out, log back in - the form now suggests the previous code when you click on it * Apply patch * Reload things (restart_all on ktd) * Verify that you no longer get the suggestion Signed-off-by: David Nind <david@davidnind.com>
Created attachment 150210 [details] [review] Bug 33253: Turn off autocompletion for 2FA authentication code The form for entering your authentication code shoudl not suggest previous codes. To test: * Activate TwoFactorAuthentication * Go to your patron account in staff * More > Manage 2-factor authentication * I used "Google authenticator" on my phone, so: * Open app on your phone, add new and scan the QR code * Enter activation code * Log out of staff interface * Log back in, you are now also asked for an authentication code as second step * Look up code in app, enter, get logged in * Log out, log back in - the form now suggests the previous code when you click on it * Apply patch * Reload things (restart_all on ktd) * Verify that you no longer get the suggestion Signed-off-by: David Nind <david@davidnind.com> Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Pushed to master for 23.05. Nice work everyone, thanks!
Nice work everyone! Pushed to stable for 22.11.x