Duo Security Blog

I don't think it's that the stack doesn't exist anywhere. It's more that the best authentication systems are siloed within a few select organizations and trust across organizations is spotty. If I had to recommend a single simple+powerful auth system right now, it would likely be Duo Security[1]. And there are countries (SKorea, Estonia) and even organizations within the US (US DoD) which have largely solved authentication. SKorea and Estonia allow (require?) digital transactions to use their state-issued digital ID. The US DoD has ID cards, digital login systems, etc (although it's not clear to me how homogenous or "simple" it is). Windows is working on "Hello". Apple has (TouchID + FaceID + iTunes/iCloud). Facebook properties use the FB auth stack(s). Google properties use its auth stack. Amazon properties use its auth stack. I think the complexity is that there is no "one account to rule them all", but I'm not sure I would trust any organization listed above to not screw it up. The US DoD is probably best equipped to understand the needs of building a robust authentication solution, but they also have physical control of their persons and don't necessarily need to work on the timeframes that the other companies listed here work on. Every single organization I've listed has had at least one high profile data/IP breach, so I would argue it's the asymmetric nature of defense versus attack that is the problem in the current internet space. [1] https://duo.com/

Take for example a university. Many of them seem to use Duo[1], which is not something you can replace with Google Authenticator or other TOTP app. They require it for students as well as faculty and staff. Is it reasonable for them to have to provide a device to all those people, forcing them to carry two devices around, and then also deal with replacing lost or broken devices? The cost of this would simply be added to the technology fee that students have to pay, when they all already have smartphones and could use the app for no additional cost. [1] https://duo.com/

If you are interested in a conceptual guide to SAML, rather than a walk through which shows XML, this is still the best one I know of: https://duo.com/blog/the-beer-drinkers-guide-to-saml Saw some simplifications in the post like where the signature goes (it can go in the assertion but also can go in the response) but appreciate this is a gentle intro, as the author states: > I’ve omitted a lot of details here, some of which matter greatly for security reasons. One thing about SAML is that, like HTML, the world is the best test case, and you can run into compatibility issues over and over (hyrums law and all that). My employer, FusionAuth, also supports SAML and has for years (first commit to our open source SAML bindings was in 2019) and there are still edge cases we run into.

I assume this is referring to Duo Security, owned by Cisco: https://duo.com/

This is a great project and really easy to use if you're even slightly technical. If you're looking for something that someone else manages at the cost of giving away sensitive organizational data, Duo Insight is free from a well respected vendor (Cisco acquisition notwithstanding) - https://duo.com/resources/duo-insight

I'm curious what the percentage of npm publishers that have this toggled on is, and I wish that was available data. First, in terms of all packages, and then of top 1000 packages. I'll wildly guess <0.5% of all packages, and <1% of top 1000. You don't get 2FA without the beta client right now anyway. It's of no surprise to anyone that follows Node.js security at this stage that the third party dependency chain is really its biggest weak link. Jordan Wright did some good research a couple of months ago on Node dependency trees and malicious packages that's worth a read: https://duo.com/blog/hunting-malicious-npm-packages

multi factor authentication. https://duo.com/ which is not related to the google app.

It was probably the worst way they could have implemented 2FA; we're still vulnerable to a MITM attack. One of the more annoying things is that the codes are sent from a random 386 number. Out of the 7+ texts I've received thus far, only 2 were from the same number. Apparently the company they're using is named https://duo.com/

Duo: https://duo.com Super easy to setup and use. About $1/user/month, so fairly cheap.

https://duo.com/ also provides a service (with free and paid tiers) to enable this in a range of applications.

Terrible name there is already a popular security auth app called Duo with a similarly named mobile app. https://duo.com/ This is likely trademark infringement because they are both on the app store and it is easy to confuse the two apps and they are both the top 2 apps now on the play store

1Password family has been hard to get everyone on… one or two people yes, but not the entire family. YouTube Premium is probably the only thing everyone in the family uses significantly and frequently… but mostly because they don’t notice it. Netflix, Disney+ maybe go without saying. Alexa/Google/HomePods too, mostly for music playback. Spotify Premium has excellent family features also. Background but storage from Google One, Apple and Microsoft Office are also frequently used and relied on. For me the hardest part is actually telling family what they could have access to - I wish there was something like https://duo.com/assets/img/leadin-images/sso_leadin_img.jpg but included all the content, apps and subscriptions we share, regardless of service provider. Whatever it is, it has to have tight integration with mobile and desktop computers so I and others can push notifications like, “Amy just signed up for NYTimes, add a shortcut and saved password?” Or a banner appears or customized Kagi results that could say, “Listen on Spotify,” if that’s what we have signed up for would be nice. I’m thinking it might work like Apple’s notifications for health and/or activity sharing, where you get to see what others do, but instead you get to see what you have access to via the family, etc. I tried setting up enterprise style accounts and domains and even a Google Site for this purpose and it went nowhere. Everyone already has logins and identities and half the problem is no one…

Some of the comments here seem to argue that creating legislation that demands basic security baselines will not get the job done. In fact in a recent interview[1] Jen Easterly (head of CISA gov) fell into the same trap (assuming because she didn't want to upset tech company lobby groups) so her message was reduced to shouting into the void (asking vendors "please be-good"): > Addressing these issues requires a long-term approach and not simply a new set of regulations or industry standards. Easterly said it will require the leaders of technology companies to focus explicitly on building safer products, provide transparency into their development and manufacturing processes, and an understanding that the burden of safety should not fall solely (or even mainly) on customers. I'm right now struggling to get a bunch of US IoT companies to agree on a very basic set of security standards that would allow more interoperability. All we're asking are basic best practice to anyone working in security (e.g. ETSI 303 645). And the reason why I'm struggling is because in the EU these baselines are becoming the law as of 1st Aug. 2024 with the Radio Equipment Directive (RED). And in addition these same kind of guardrails will also become law with the Cybersec Resilience Act in 2025 expanded to the cloud and mobile apps. So this thing is coming and the US which has a lot better standards (thanks to NIST but lacks legalization due to power of lobby groups) looks like a total laggard here…

Note, Google in typical fashion has named 6+ products "Titan." (Titan M, Titan C, Titan Security Key (available in USB A, C, Bluetooth versions), Titan Security Module, OpenTitan, and maybe a few more if you count the old Bluetooth versions that were recalled that look identical to the new Bluetooth version). The various Titan Security Keys are also made by Feitian who sometimes use the same auth chip and sometimes don't but externally look identical. The products sole purpose is to establish a secure chain of trust and starts out the gate broken with ambiguous or misleading claims for verifying exactly which Titan it is. Google will pay you $1 million to hack the Titan but not the Titan hacked here - the other Titan[1]. Furthermore they are happy to tell you that their products, like Google Cloud Platform, are "Secured by Titan" but not which Titan [2]. This is frustrating because the Titan M is an absolutely brilliant device, with some real advancements to normalize embedded security, including an SPI interposer to monitor communications (a real leap forward) - and should not at all be conflated with a generic, whitelabeled, non-hsm product that makes no claims whatsoever and has been broken at least twice before [3] [4]. The Titan C is an even bigger improvement over the Titan M but not in anyway they care to disclose which may or may not indicate weaknesses in Titan M [5]. Likewise, OpenTitan[6] is crashing through barriers others didn't even know were there in…

Duo Security | Senior Application Security Engineer | Ann Arbor, MI or Austin, TX | ONSITE | https://duo.com/ We are Duo, and we’re here to democratize security for everyone. Our mission is to protect the mission of our customers like Facebook, Twitter, and Etsy by making security simple. We’re a diverse crew of makers and builders, skaters and coders, filmmakers and DJ’s, teachers and students brought together by a shared belief in adding value to the world. This diversity allows us to bring an empathetic approach to solve some of the most complex global business and security challenges we face today. What you’ll do… -Perform security activities, including security design reviews, threat modeling, code auditing, and security assessments on internally & externally developed software. -Support product security issue triage, help coordinate 3rd-party security assessments, provide ad-hoc technical security expertise to product, sales, & engineering teammates. -Create and maintain application security development policies, procedures & standards. Skills you have… - You have a strong understanding of many vulnerability classes impacting a variety of languages, with an expertise towards Python, Javascript, Java, C, C#, and Objective-C. - You’re comfortable manually auditing code for vulnerabilities, using static & dynamic code analysis tools, building custom security tools, and bootstrapping test environments. - You understand security engineering principles, and how to…

If a user can use any TOTP app of their choice, what's the mitigation for them installing a malware TOTP app that ships their private keys directly to CCP HQ? Duo is regularly audited by independent third-party assessors to attest SDCL, data protection in their datacenters, etc.[1] Audits aren't a guarantee but they provide a reasonable amount of assurance that their software products and infrastructure have at least basic data protection measures. > if your android phone is rooted, you can export Duo Mobile keys This is the exact reason why personally owned devices, in most organizations, require MDM enrollment and attestation before being granted access to corporate resources. [1] https://duo.com/solutions/compliance

Are you sure that is the one for this blog post? i got the impression that was a different vuln for a different saml implementation. Also using comments to bypass saml is very old news. https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple… is a post from 2018 about it.

Because they're part of APT45 which has been documented doing this as part of the North Korean military for over a decade now [0][1][2] You can also read the DoJ press release if you want [3], but you'll probably be blocked by their WAF as you're based in Russia [0] - https://cloud.google.com/blog/topics/threat-intelligence/apt45-north-k… [1] - https://duo.com/decipher/north-korean-apt45-goes-for-the-money [2] - https://malpedia.caad.fkie.fraunhofer.de/actor/apt45 [3] - https://www.justice.gov/usao-mdtn/pr/department-disrupts-north-korean-…

Lots of people use 1.1.1.1 without knowing it. Firefox, for example, uses DoH by default. The default resolver for the US is Cloudflare. https://support.mozilla.org/en-US/kb/firefox-dns-over-https#w_about-ou… Chrome followed: https://duo.com/decipher/google-makes-dns-over-https-default-in-chrome

It’s a continuation of the trend that led to them removing Extended Validation indicators: https://duo.com/decipher/chrome-and-firefox-removing-ev-certificate-in… Here’s how they used to appear: https://pbs.twimg.com/media/EBxdA7EWsAIQtc0.jpg While I buy the reasoning that consumers simply ignore them, EV indicators would be really useful in a corporate setting to mitigate phishing attempts against employees. It’s much easier to train employees to “look for your company’s name in the green bar” before they sign into a site, than to understand how domains work and why login.yourcompany.com is OK but login-yourcompany.com isn’t. Does anyone know if it’s possible to restore EV indicators in Chrome via MDM software or similar? Does anyone work at a company that does this?

2FA bypass bugs on websites are common, e.g. this PayPal bypass that stemmed from them allowing their own app through without 2FA, since their app didn't support 2FA at the time: https://duo.com/blog/duo-security-researchers-uncover-bypass-of-paypal…

This article [1] includes a quote describing a specific vulnerability that would pay the $1 million. > "We are introducing a top prize of $1 million for a full chain remote code execution exploit with persistence which compromises the Titan M secure element on Pixel devices. Additionally, we will be launching a specific program offering a 50% bonus for exploits found on specific developer preview versions of Android, meaning our top prize is now $1.5 million," Jessica Lin of the Android security team said. > The Titan M bounty applies to the Google phones that have the chip, which include the Pixel 3 and 3 XL, 3a and 3a XL, and 4. [1] https://duo.com/decipher/hack-the-titan-m-get-usd1-million

404 on submitted link (it got mangled) - working link is https://duo.com/decipher/krebs-we-ve-over-fetishized-the-apt-threat [Edit to Update - Flagged for Mods attention - link is missing the final 'T' in submitted link]

Browsers stopped displaying EV indicators in the URL bar. Barely anyone noticed. https://duo.com/decipher/chrome-and-firefox-removing-ev-certificate-in…

I found a page by Duo Labs listing Noise in Production. https://duo.com/labs/tech-notes/noise-protocol-framework-intro Noise is used today in several high-profile projects: WhatsApp uses the "Noise Pipes" construction from the specification to perform encryption of client-server communications WireGuard, a modern VPN, uses the Noise IK pattern to establish encrypted channels between clients Slack's Nebula project, an overlay networking tool, uses Noise The Lightning Network uses Noise I2P uses Noise

I use a wired keyboard for latency, FileVault, and reliability reasons. I’m not concerned about the security. If someone is close enough to sniff BT packets, they can also do acoustic analysis of your typing, or a TEMPEST attack on the (plaintext!) USB protocol. BT can have about the same level of encryption as TLS. https://duo.com/decipher/understanding-bluetooth-security

Searching "gmail oauth malicious" https://duo.com/blog/gmail-oauth-phishing-goes-viral

Here's an example from 2018 of someone trying to extract secrets from a Yubikey. https://duo.com/labs/research/microcontroller-firmware-recovery-using-… Seems they don't get very far. Or it's at least very laborious. But as you say, who knows what a cutting edge lab can do. Skimming the web, it seems like people have had more success with things like Google Titan keys.

Usually with authentication on linux, pam is a good starting point https://duo.com/docs/duounix