jonoberheide

5 ms·

1.
by jonoberheide 10y ago
Hi Paul! I believe your token should automatically resync if you enter three consecutive correct passcodes that are outside (but forward of) the current valid window.
2.
by jonoberheide 10y ago
I think that's a fair read. The primary use of that data is for security use cases. Eg. if you're coming from an out-of-date browser or have risky Java/Flash plugin versions, we can notify you to update/remediate. Anothe
3.
by jonoberheide 10y ago
No prob! I can't claim to be a HN veteran (/me glares at @tqbf), but if I hear people are having issues, happy to help.
4.
by jonoberheide 10y ago
Sorry to hear about your experience, Jarwain! Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organization. Duo Push is actually one of the easiest (and most secure)
5.
by jonoberheide 14y ago
If anyone can quickly point me at the CM9 kernel source, I can verify whether or not this is actually patched. The vulnerability is looking checking to see if the mem_write() function is functional (where the vulnerability was present), whi
6.
by jonoberheide 14y ago
4.1 is definitely the most secure Android you can be running currently. We posted about some of the security improvements in Jelly Bean 4.1 last week: https://blog.duosecurity.com/2012/07/exploit-mitigations-in-...
7.
by jonoberheide 14y ago
We'd love to be able to publish it in the Play Store, but we were informed by Google that the terms of service disallow any apps that check for vulnerabilities, despite X-Ray's good intentions. It's a weird distinction that they allow AV-li
8.
by jonoberheide 14y ago
X-Ray author here, happy to answer any questions folks have!
9.
by jonoberheide 14y ago
FYI, it is possible for unprivileged apps to invoke the INSTALL_ASSET functionality themselves. One such example described here: http://blog.duosecurity.com/2011/05/when-angry-birds-attack-... Another variation of that attack is still unp
10.
by jonoberheide 15y ago
Yeah, I'm guessing ARM will be ok with respect to GPRs (although I certainly haven't done any benchmarks). Dug's FUBAR comment was just an attempt cram in as many acronyms as possible...of course the situation is improvable. ;-) Still at CO
11.
by jonoberheide 15y ago
GRKERNSEC_BRUTE will also trigger for suid binaries (in the case of memprodroid, run-as). See gr_handle_brute_attach() for details.
12.
by jonoberheide 15y ago
Yeah, mempodroid is a great example. You'd need to randomize the location of the setuid executable (w/PIE), randomize of the linker, and implement something like GRKERNSEC_BRUTE to prevent trivial local bruteforcing of a usable address. Spe
13.
by jonoberheide 15y ago
Right, all libaries need to be compiled with -fPIC in order to be randomized. That tends to be much more common than -fPIE.
14.
by jonoberheide 15y ago
There's still a large attack surface of native code in the Android platform. I've heard WebKit has a few bugs... :-P
15.
Working around phoney SSL certificates on iOS (...or not)(blog.duosecurity.com)
1 points by jonoberheide 15y ago|0 comments
16.
Two-factor auth for WordPress blogs(blog.duosecurity.com)
5 points by jonoberheide 15y ago|0 comments
17.
by jonoberheide 15y ago
Duo offers a number of features above and beyond Google Authenticator: - more flexibility in choice of authentication method (voice, SMS, soft token, hard token, Duo Push) - more supported mobile platforms (Android, iPhone, Blackberry, WinM
18.
by jonoberheide 15y ago
Check out the login_duo(8) man page. You can specify a failmode configuration option to fail safe (allow access) or fail secure (deny access) if there is a connectivity loss between your servers and Duo's service.