-
-
Notifications
You must be signed in to change notification settings - Fork 2.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
0x04e - About OTP Authentication Checks #1938
Conversation
Thanks for the PR, @Saket-taneja While I understand what you are trying to say, I don't know if this is the right place to do it. This section is about a backend enforcing 2FA, after which it will provide new information to the user (e.g. sensitive data). In your case, if the server simply returns true/false, it would mean that the sensitive information is already stored locally, or that there is client-side validation; both of which are already covered in the MASVS/MSTG. Your recommendation also wouldn't fix the problem. If you say "> The application should always pass user token or some dynamic information related to the user to prevent the attack", then the backend could still simply return true / false and you would still be 'vulnerable' or at least have the same issue. As I mentioned in #1939, it's best to first open an issue so that we can have a discussion on the merit of the addition. |
I agree with @TheDauntless, and please don't hesitate to raise issues whenever you feel that something's missing or incomplete. If something is already covered or not applicable we can save you the effort of working on PRs. Thanks @Saket-taneja :) |
@TheDauntless The case which i have enlisted over here also entails that in many of the cases , the application is configured in a way that server returns only true/false when 2fa is enabled.There are numerous reports on hackerone and bugcrowd you can refer that.The solution to almost all of them is that they all were using static responses and should be avoided. CC : @cpholguera |
Hi @Saket-taneja, could you please provide a couple of links to those reports? We'll take a look and if needed we'll open an issue for this. |
@cpholguera Hey Buddy any updates on this ? |
Hi @Saket-taneja, thanks for reaching out! We'll address more PRs in the upcoming year. As you might know we're in the middle of a big refactoring for the MASVS which will extend to the MSTG. We were also improving our pipelines so that we can release more often. Thanks for your patience and congratulations for making it to our list of New Contributors! 🎉 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @Saket-taneja, thanks a lot for your PR and sorry for the late response from our side. We had to give more priority to the MASVS refactoring process and we are still working on it.
Here are a couple of suggested changes, if you like them you can click on the button "Commit suggestion" and they'll be integrated. Thanks a lot for the PR and for your patience!
Document/0x04e-Testing-Authentication-and-Session-Management.md
Outdated
Show resolved
Hide resolved
Document/0x04e-Testing-Authentication-and-Session-Management.md
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks a lot @Saket-taneja for your contribution and your patience. We're ready to go!
Thank you for submitting a Pull Request to the Mobile Security Testing Guide. Please make sure that:
If your PR is related to an issue. Please end your PR test with the following line:
This PR closes #< insert number here >.