A complete bypass of eMudhra’s 1FA OTP login system

EQYV

Please can this not be true..

FLeXMurphy

Security represents less than 1% of their business.

bragr

The anti AI scraping on this site doesn't work that well. I'm being served non-sense text about buttplugs. I'm human, I swear.

gilrain

This site serves me garbage. Iocaine, I think? I use Brave. "If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting." If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.

buildbot

So basically anyone who used this CA is screwed if someone knows your email?

VladVladikoff

Hahahahha what a roast. Too funny, especially the "4 Bars" in the background of the demo.

tommica

Could someone explain this? Does this mean that it enables logging in as any account in emudhras infra?

hoherd

The number the tool found was 1861. The e-mailed OTP code was 1858. What am I missing?

cyberpunk

Don't piss off the internet, there will be consequences. I guess.

baal80spam

"S" in "eMudhra stands for "Secure".

jttnr

Oh man, good that they are leaving the CA business. https://news.ycombinator.com/item?id=50195110

ignatella

I understand it in the following way: They put the public key into js and encrypt the body of the request. This is common practice to protect users' important data from being accessed by a proxy (in this case, Cloudflare) and is ok. But the real bug is that they don't rate-limit, invalidate, or protect the endpoint related to OTP checks, so it can be brute-forced, as the search space is limited.

trallnag

Damn, these Mastodon accounts are a rabbit hole to get lost in

greenavocado

Cut the undersea cables already

skeledrew

I guess certs isn't the only thing they'll be exiting.