Re: [OATH-Toolkit-help] different users with one token

[Simon Josefsson]

Christian Hesse <address@hidden> writes:

> Hello everybody,
>
> I do use one token to authenticate my user account and the administrative
> account root. Now there is a security concern about this configuration: The
> same one time password can be used to authenticate one, then the other user.
> Is this by design or should all counters for one specific token in users file
> be increased regardless of user?

The assumption has been that you only have one token for one user, so it
is a design issue.

I don't see how to fix it easily with the current usersfile database
model though -- there is no concept of token identity that could be used
to find other users accounts that have the same token.  There is the
secret key, but you COULD have different tokens programmed with the same
secret key, but still want to use them for different accounts and
maintain separate counters.

The solution is to design a better model for how information about
tokens are stored and updated.  Each token should have a unique
identification, and there can be a M:N mapping between tokens and users,
and the mappings could be overlapping.  It could be an abstract model,
and there could be instantiations for common scenarios like 1)
file-based model, 2) SQL/noSQL-approach, 3) LDAP.  It isn't really a lot
of work to design once we start to work on it...

/Simon