debuilder.infra.ooni.io compromised month ago about sysadmin

[darkk]

network-level authentication (SSH, VPN, nginx with basic auth) on internal services

I had a bikeshedding session with @hellais about that and we concluded:

• nginx with basic auth stores secret in browser memory till reboot and that's OK
• nginx with basic auth has ugly login form and that's OK
• nginx with basic auth has no 2FA / U2F support and will never have and that's OK
• nginx with basic auth requires good random non-memorable passwords to make pw check single round of SHA1 and that's OK
• nginx with basic auth requires separate password for every single webservice and that's OK as everyone knows how to use password manager
• SSO is nice and nginx-sso following pubcookie model is quite simple, but that's still hundreds lines of golang code and some extra complexity and potential SPOF

[darkk]

Awesome example of in-app auth bypass:
https://bo0om.ru/just-enter-the-space-attacks
Sorry, in Russian. Long story short: just add %20, authentication and url routing are done in wrong order – boom!

[hellais]

ooni/backend#343