16
[EURid registry] Is a 6 character lowercase alphanumeric password (31b entropy) which randomly changes every 2 hours safe enough for online service (possibly) without proper rate limiting? (lemmy.sdf.org)
submitted 1 week ago by to c/cybersecurity@sh.itjust.works
8 comments fedilink hide all child comments
 

I've recently registered a .eu domain name.

EURid registry has a portal where you can generate a transfer code, thus not fully relying on access to registrar (as well as check and verify your info).

Welp, security.

The only security is a code sent to e-mail associated with the domain. While the portal requires entering this address to log in, it can also be pulled from WHOIS where it is mandatorily published.
Regardless, e-mail (as a string) should not be affecting security.

The code, as I mentioned, is just lowercase letters and numbers. Precisely 6 of them. This is valid for 2 hours and one use.
While there is a "Request new code" button, I wasn't able to generate multiple codes for one 2 hour window, so that's good.

But now we get to rate-limiting. After 9 attempts, I get:

You have exceeded the allowed number of requests.
Please try again in 10 minutes.

Sounds good, BUT, clearing cookies bypasses this.
I have not (yet) tried any automation, I just quickly manually repeated this tomfoolery from same IP 3 times without actually being rate-limited.

I find this... at least strange. Especially since everyone is doing at least 2FA, while some sites even support physical security keys, and then there's "we email you 6 characters".

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 week ago

and would not raise red flags with the registrar

That's the real determing factor here, they are visibly limiting to 10 tries every 10 minutes, but if there's another limit such as 100 failed tries per password (per 2 hours) absolute max or whatever, that can make a huge difference.

If you want to hope for unicorns and rainbows, you might even think they use the higher failure limit as a flag to start investigation into where the abuse is coming from and doing what they can to stop it at its source - you'd want to encourage the abusers to keep trying in order for that kind of scheme to work.

I just had an idea for a system which lets you try 10 times in 10 minutes, lets you bypass that limit by tossing your cookies or whatever, but - after 100 failed tries on this 2 hour password, even if you guess correctly it doesn't let you in anyway, just acts like you put in another wrong guess, but... for attackers that continue to try it initiates a backtrace...

  • permalink
  • fedilink
  • source
  • parent