• Lmaydev@programming.dev
    link
    fedilink
    English
    arrow-up
    146
    arrow-down
    4
    ·
    9 months ago

    There was a chap on here the other day who said they hate 2fa and don’t need it because they use passwords that are 50 characters and generated by the password manager.

    This is a perfect example of why you should always activate it when possible.

    • Specal@lemmy.world
      link
      fedilink
      English
      arrow-up
      47
      arrow-down
      7
      ·
      9 months ago

      Alot of people don’t like Microsoft, but they’re pushing for zero password authentication for a reason. Passwords are getting really insecure really fast.

      • andrew@lemmy.stuart.fun
        link
        fedilink
        English
        arrow-up
        33
        arrow-down
        1
        ·
        edit-2
        9 months ago

        This vulnerability has nothing to do with password strength or security and everything to do with password reset security, i.e. email and improper handling of parameters to that reset API call.

        Passkeys are interesting and potentially quite strong but they’re going to have to fall back to the same old reset mechanism if you e.g. drop your passkey device (phone) into a lake.

        • hydration9806@lemmy.ml
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          4
          ·
          9 months ago

          Or just make it clear your account is gone if you lose your passkey, so have a second key for backup or learn a hard lesson.

        • Specal@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          9 months ago

          I just use their Authenticator app out of convenience, I get a notification when I login through it and it asks me to input the correct number given by the app, a 2 digit number.

      • CubitOom@infosec.pub
        link
        fedilink
        English
        arrow-up
        2
        ·
        9 months ago

        How does Microsoft’s implementation work?

        Is it possible to log into windows without a Microsoft account using that method?

    • whyNotSquirrel@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      15
      ·
      9 months ago

      I see a lot of people around me resetting passwords of services they rarely use because they forgot what password they used and don’t have a password manager (or not synced one). And I don’t understand why all services don’t propose to generate a one time link to log in instead of changing passwords (a few services do propose it already)

      Passwords are useless for all users using the same password for every account they have, and i’m sure it’s a majority of users.

    • pizzawithdirt@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      9 months ago

      I don’t have 2FA for my GitLab account since it’s only accesible via my GitHub account which has 2FA. Is this good or should I add 2FA to GitLab also?

        • BirdsWithBeefyArms@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          9 months ago

          This isn’t necessarily true. If you are using an identity provider, you can still perform a password reset on GitLab and set a password there, bypassing your 2FA on GitHub. You usually shouldnt rely on IdP 2FA unless the destination system enforces IdP signin every time. There is a group setting in GitLab that does that, but it will only apply for that group.

    • CubitOom@infosec.pub
      link
      fedilink
      English
      arrow-up
      4
      arrow-down
      2
      ·
      9 months ago

      One of the biggest issues with 2fa is that normally it’s either an easily spoofable phone/email or an app locked to a device.

      This is why I use a password manager (pass) that is synced across all of my devices (via a private self hosted git for version control) that I can send 2fa QR codes to cameraless devices via screenshots using zbarimg and have every device capable of 2fa verification with the pass-otp extension.

      I know this setup is a bit complicated as just dealing with git or importing a gpg key would give most people I know sense of existential dread. I am curious to see what others use for similar functionality.

  • cheet@infosec.pub
    link
    fedilink
    English
    arrow-up
    47
    ·
    9 months ago

    We use gitlab ultimate at my work, I’m the main admin of the instance. Like 2 weeks ago when there was the cvss 10 vuln, gitlab sent us a .patch file to apply to the instance instead of releasing a new minor cause they didn’t wanna make the vuln public yet. I guess that’s coordinated disclosure, but I still found that remarkably jank.

  • reinar@distress.digital
    link
    fedilink
    English
    arrow-up
    29
    ·
    9 months ago

    bruh, feels like gitlab has security update every other day, it’s some bullshit even for a project this size. And who knows how many 0-days are around.

    • CriticalMiss@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      9 months ago

      I’ve been hanging a version back for a while now. Although my instance isn’t public, it’s ridiculous how many CVEs I have dodged by not updating. SolarWinds all over again.

      • rainynight65@feddit.de
        link
        fedilink
        English
        arrow-up
        2
        ·
        9 months ago

        No it doesn’t. Gitlab’s pricing has been pretty stable, with one increase in the premium tier in the past six years ($19 --> $29 per user per month).

        • bamboo@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          2
          ·
          9 months ago

          There were more increases, they just changed the tier names and billing terms, so it’s somewhat hard to find historical information of previous prices. Our company ditched it after the 52% increase in 2023, especially because we were still adjusting to the price increase from 2021, which for us was $6 per user per month. I think in 2018 or 2019 it was $3 per user per month, so there must have been another increase that happened between 2018 and 2021. This was all for self hosted, so we had the additional cost of hardware and to maintain the services.

          I really wanted to support GitLab, but the price simply became too much to justify.

  • Rimu@piefed.social
    link
    fedilink
    arrow-up
    21
    ·
    9 months ago

    Check gitlab-rails/production_json.log for HTTP requests to the /users/password path with params.value.email consisting of a JSON array with multiple email addresses.

    Jesus Christ. Their frontend was sending a list of recipients to the backend. That’s an intern developer level of fuck up, in their login system, no less.

    If this got past them, it’s a sign of deep problems.

      • diffusive@lemmy.world
        link
        fedilink
        English
        arrow-up
        3
        ·
        9 months ago

        Not the commenter but it seems like the parameters of the HTTP Get/Post weren’t protected/checked. The API was likely something like: Email to reset: string(email account to reset) But it accepted something like: [string(email account to reset), string (email to which the reset mail is sent to)]

          • diffusive@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            9 months ago

            Bobby table, this, buffer overflow… Are all similar in spirit.

            Bobby table is a way for hiding the malicious SQL query after a normal query (in that case after the select with “Bobby” you inject the malicious drop table)

            In this case after the normal email (that normally would serve for both identifying the user and for the mail to send the recovering mail), the attacker sends two mails, the first is fo identifying the user the second to send the recovering mail

            In the case of buffer overflow you inject malicious code after normal(-ish) data

            It’s not an XHR attack since for the mail recovery workflow you don’t need an authenticated session.

            To be a bit more compassionate to the developers, this is probably some dynamic typing problem. Probably ruby is “smart” into understand that an array can contain strings after all… So an array of strings is as good as a string… But here we go into static vs dynamic typing… And it’s a bit of religious war (fun fact in 2011 i was advocating with Guido Van Rossum in having at least an optional static typing check in Python - at the time the discussion was how to make python faster/compiled - and he was borderline mocking me 😅 and few years after pytypes but still no compilation at horizon 😂)

            • Ann Archy@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              9 months ago

              Thanks for the explanation, my friend!

              My problem is that I am a hopeless generalist (which basically means I invariably find myself in support positions rather than what I actually should be doing), and IT is an endless jungle. I’m too curious for my own good.