search

duo-labs / py_webauthn

Pythonic WebAuthn 🐍
https://duo-labs.github.io/py_webauthn
BSD 3-Clause "New" or "Revised" License
856 stars 171 forks source link

Minor data leak #47

Closed bortels closed 3 years ago

bortels commented 5 years ago

The behavior on login is different depending on if the user exists (you are prompted to activate the device) versus does not exist (you are told so). This would allow an attacker to test candidate users to find if they have a registered device, and perhaps then target that user. (I know "Bob Smith" works for such-and-so, and "bsmith" is a valid name, time to steal his keyring with his fido2 device at lunch). It's a stretch, but it's probably best if the authentication pretends the username is valid no matter what, and gives the same response to both scenarios, so attackers can't use account validity as a filter.

futureimperfect commented 5 years ago

Hi @bortels,

Thanks for providing this feedback. It's something I've thought about, and I also know has been a general concern with WebAuthn when credential IDs are revealed when a valid username is provided.

I'll think about this some more and come up with a plan.

Thanks again!

nickmooney commented 4 years ago

I think a solution to this would be to deterministically create random allowLists for unknown usernames. This could be done using an HMAC keyed on a secret key with the username as input.