CMDR Yojimbosan [UTC+13] @yojimbo@hackers.town

#introduction I've been hacking unix systems since the mid-80s in a good way, and I try to stay in the unix/free software/open source software world as much as possible.

I build far too many workflows that mix bash, python, awk, sed and golang together to drag data from odd places, polish it up, and put the results somewhere where the sun does shine. With possibly less input safety than is needed ...

For money, I do infosec. For fun, I play Elite:Dangerous and help run the in-universe radio station RadioSidewinder.com.

I also live somewhere that isn't in your timezone, have a family that just wants their tech to work, and look forward to owning electric vehicles.

https://www.kickstarter.com/projects/thelevelup/ice-dice

Ice Dice. Dice, made from ice.

Need I say more?

I've figured out the coronavirus strategy for the 'failing' countries ...

"Dead people cast no votes"

Bitwarden has been automatically sending Basic Auth login attempts inappropriately ...

https://twitter.com/RitzmannMarkus/status/1307614248835731456

This has been addressed already, but all the same ... ouch.

I'm not convinced about cursive in any context (you try doing family history research with original documents!) but this here is a monospaced cursive font for programming ...

https://rubjo.github.io/victor-mono/

I've implemented a 'social login' to a private family tree website, that uses open-source software on my end to hand off the whole authentication later to google, but keeps the authorization layer with me having access to the users' email address ...

I'm actually very surprised that it worked after only a couple of hours hacking!

nginx has a module called auth_request, that has a very simple contract with an "identity provider" that you will probably run on the same machine. It returns 200 or 401. If you get a 401 they're not currently logged in, and you redirect them to a login page.

https://github.com/vouch/vouch-proxy provides a small and neat implementation on Go (not that I care, because at the moment I'm using it via Docker Hub). There's a small config file that says "these usernames are OK" (so a manual list in the config of approved email addresses) and "Use oauth to google, using my ClientID and ClientSecret".

Google hand out an API setup basically free, if you don't ask for any sensitive data you don't have to be manually validated. There's some indication that it'll perhaps need validation some time in the future, after 100 users, but that's not going to be an issue here. In any case, it works ...

So previously I had this family tree website locked down to our home static IP, but now my wife can go to the local library, get their genealogy records, and still log in to the thing; and no-one else can :-)

Another possibility is JOSSO, but that's a big java set of servers, and depends on flash for the UI (until the next release, due RSN)

This is beginning to look like perhaps nginx with it's auth_request module, talking to an instance of vouch ... suggestion via Okta, who write great docs :-) https://developer.okta.com/blog/2018/08/28/nginx-auth-request

Also actually, if you get this far down, this is very very true ...

In conclusion, to be a hacker u ask for tap water.

The hacker known as "Alex" (because that's his name) has been at it again ...

https://mango.pdf.zone/finding-former-australian-prime-minister-tony-abbotts-passport-number-on-instagram

For security reasons, we try to change our Prime Minister every six months, and to never use the same Prime Minister on multiple websites.

Actually lets change that around ...

I'd rather have an authorization layer than an authentication one. Push off the actual identification phase to federation with google/apple/facebook and then all the potential external users won't have another password to remember.

I'd like proper MFA though - when I'm logging in from the house the src IP address is a good identifier, if I'm coming in from outside then tokens are needed ... that sort of thing.

So not a user directory so much as a federation thing. Is that what Keycloak does?