rugk / xenforo-threema-gateway

Threema Gateway implementation for XenForo, offers two-step-authentication (or two-factor-authentication 2FA) for users

XenForo - Threema Gateway (two-factor-authentication)

This project has been abandoned due to lack of users. You can fork it or contact the author via mail in case you want to continue it or have some other idea about it. In case one notices me of major vulnerabilities, I may still try to fix them, if the add-on is actually used, but the project itself has to be considered unmaintained and will not receive further developement.

This add-on integrates the secure instant-messaging app Threema into the forum software XenForo. Using the Threema Gateway it offers three new two-step authentication (also called two-factor authentication) modes for users and admins.

Features

Three 2FA modes offer you and your users a flexible and secure way for easily securing their account. Multiple settings allow server admins to configure and/or restrict any aspect of the add-on and one can always extend this add-on to do other things with the Threema Gateway.
The add-on is built with security, flexibility and user choice in mind and is straightforward to use.

Featured FAQs:

• What is 2FA and why should I use 2FA?
• Why should not I use SMS for 2FA?
• Why use Threema?

Users

• Multiple two step/two factor authentication modes allow you to choose the most suitable for yourself.
• For each authentication method there are several options, which can be set by the user.
• Users can use different Threema IDs for each two step verification method.
• All methods work flawless on mobile and on desktop devices.
• Users can add their Threema ID to their profile.
• Your Threema ID is automatically looked up based on your mail or phone number. (configurable by the server admin)

Administrators

• You can use both the basic mode and the end-to-end mode. (although the latter is recommend and provides more features)
• You can see the Gateway status in the ACP at a glance.
• You can see your remaining credits in the ACP at a glance.
• You can use the Gateway completely without offering two factor authentication (2FA) or limit the 2FA methods.
• The ACP helps you with the whole setup. Beginning with the installation of Libsodium until creating your private key and configuring the add-on's settings.
• An installation guide helps you through all steps you need to make this add-on working.

Developers

• This add-on can easily be extended as it provides an API you can use to do your own things with the Threema Gateway.
• You can find extensive instructions in the docs dir.

Security

• This add-on is open source, so you and other people can check what it does and that nothing malicious is done.
• You can set permissions which users can send or receive messages with the Threema Gateway.
• Threema ID verification QR codes are shown when appropiate. Their generation is done (locally) on the XenForo server/in the users's browser.
• Sensitive settings are hidden in the ACP and you can even prevent administrators from viewing your remaining credits.
• You can generate the private key on the server and even place it outside of the web root by just specifying the file path. This means your private key never leaves the server! You also do not have to enter it into the web interface and it is never saved in the database.
• You can even hardcode your private key and other details into the PHP file instead of using the XenForo settings or the file storage (for the private key file).
• Permissions allow you to control every aspect of your Gateway.
• This add-on integrates itself into XenForo's health check.
• This add-on does only make external calls to the Threema Gateway server.
• By default the add-on uses the advanced settings of the PHP SDK, which provide better HTTPS security when sending messages.
• You can further improve the advanced connection settings with a few clicks in the ACP.
• The Gateway server pin is automatically pinned when possible. (requires cURL >= v7.39)

Requirements

• PHP 5.4 or later
• XenForo 1.5 or later
• Libsodium (strongly recommend, install guide included)
• curl (>= v7.39 suggested for better security)
• MySQL 5.5.3 or higher
• HTTPS on server (recommend, required for receiving messages and some details)
  If you have not set it up use Let's Encrypt, certificates must be valid (self-signed certificates are not accepted).

Get it now!

• Build it by yourself or
• Download the latest release

Support this project

[…]

xenforo-threema-gateway's Issues

Web interface

A web interface for sending (and receiving) messages manually would be a nice thing.

However it's a big task, but is possible as the underlying technology is already included. Also all incoming messages are already saved in the database.

Screenshots/gifs

German translation

Use nounce for replay protection

From the Threema whitepaper:

Replay Prevention
The Threema app remembers the nonce of every message that has been sent in the past, and rejects messages with duplicate nonces. Since the server cannot successfully modify the nonce of a message without knowing the private key of one of the parties involved in the communication, this prevents a malicious server from replaying/duplicating previously sent messages.

Health check

Core Infrastructure Initiative (CII) Best Practices

https://bestpractices.coreinfrastructure.org/
criteria: https://bestpractices.coreinfrastructure.org/criteria

Current status:

• homepage_url (maybe GItHub?)
• description_good (2FA is no jargon…)
• interact
• contribution
• contribution_requirements
• floss_license
• floss_license_osi
• license_location
• documentation_basics
• sites_https
• english
• repo_public
• repo_track
• repo_distributed
• repo_track
• version_unique
• version_semver
• version_tags
• release_notes
• release_notes_vulns
• report_process
• report_tracker
• report_responses
• enhancement_responses
• report_archive
• vulnerability_report_process
• vulnerability_report_private
• build
• build_common_tools ( a bash script should be more or less common, no?, anyway only suggeested)
• build_floss_tools
• test
• test_invocation
• test_most
• test_continuous_integration
• test_policy
• tests_are_added
• tests_documented_added
• warnings (hmm, compiler warnings for a PHP project, seems difficult)
• warnings_fixed
• warnings_strict
• know_secure_design
• know_common_errors
• crypto_published
• crypto_call
• crypto_floss
• crypto_keylength (needs to be checked, exact key lengths are given)
• crypto_working
• crypto_weaknesses
• crypto_pfs (N/A - we have no key agreement protocol)
• crypto_password_storage (N/A - we store no passwords)
• crypto_random (a bit N/A as we fallback to XenForos native implementation)
• delivery_mitm (HTTPS, file sums, signed release files, signed git tags)
• delivery_unsigned
• vulnerabilities_fixed_60_days
• vulnerabilities_critical_fixed
• no_leaked_credentials
• static_analysis
• static_analysis_common_vulnerabilities (scrutinizer-ci.com does)
• static_analysis_fixed (there is one not really applicable, which I mitigated in 7f74c26...2995ff7)
• static_analysis_often
• dynamic_analysis (for PHP…?)
• dynamic_analysis_enable_assertions
• dynamic_analysis_fixed (probably N/A as we do not use it)
• installation_common
• build_reproducible (at least since timestamp can be modified, commit 77a8473)
• crypto_used_network (we have few influence on it, however)
• crypto_tls12 (N/A, depends on server)
• crypto_certificate_verification (N/A, depends on server)
• crypto_verification_private (N/A, depends on server)
• hardened_site (well… GitHub, download site not hardened)
• hardening

Check Fast mode again

(Only?) in admin login modes some errors seem to happen.

Improve texts & create some "marketing" text

• look over Readme and improve it, add details or so
• look over docs (544df5f)
• complete FAQ
• create text for XenForo community
• German version for xendach
• mini website? (look for static file hoster, only redirector for donations)