Henrik Schack
Forum Replies Created
-
Forum: Plugins
In reply to: [Google Authenticator] Description and Secrets not showing in User settingsGreat 🙂
Best regards
Henrik SchackForum: Plugins
In reply to: [Google Authenticator] Description and Secrets not showing in User settingsHi Trevc
Hmm it sounds like you are looking at a useraccount different from the one you’re logged in with.Best regards
Henrik SchackForum: Plugins
In reply to: [Google Authenticator] Logged out of WP Admin before setting upFTP or SSH to your webhost and rename or delete the google-authenticator folder.
it’s in wp-content/plugins/google-authenticator
Best regards
Henrik SchackForum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsIan
Did you look into how the login cookies are being set in a multisite installation ?It it just me or doesn’t those subsite cookies contain any cookiepath information ? (and there by making them globally available on all of the installation)
Forum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsI’l get myself another VPS where I can install Apache / multisite
Forum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsI’ll dig deeper into wp_validate_auth_cookie()
But first some sleep, there is another day at work tomorrow.Personally I think network requirement is a great idea 🙂 The more secure accounts the better, everything capable of writing some sort of content on a webpage can be abused.
Forum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsauth_cookie_valid sort of works, but only for the admin area.
I guess we wouldn’t want 1/2 authenticated users to be able to post comments on posts ?It’s ugly but I think in order to fix this completely a hook into something related to each pageview is needed.
If that’s the case I think a network activation requirement is a better solution, what to you think ?
Forum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsSo this page is completely wrong ?
http://codex.wordpress.org/Plugin_API/Filter_Reference/authenticateHave you seen a good “WordPress authentication explained in detail” writing somewhere ?
I think I need to read it 🙂Forum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsAccording to the documentation authenticate is only called during login.
Isn’t the point of the issue that the user doesn’t login on the site ? but uses another site to create the WordPress authentication cookie ?Forum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsYes that would work I think.
Thinking …. is an admin page hook like admin_init enough, wouldn’t it then still be possible to hack your way into say writing comments as an authenticated user ?Forum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsRegarding :
“An alternative approach would be to store a flag when the user logs in, noting which blog they logged in from. Then on each request, check if that flag exists and if the blog it points to has the plugin enabled. If it doesn’t exist or the plugin isn’t enabled, short-circuit the authentication request and force them to login from the blog they’re trying to access.”
So setting some session cookie as part of the two factor authentication process, and adding an admin_init hook that checks for the presence and content would do the trick ?
Forum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsCrap. Multisite doesn’t like my nginx.
Forum: Plugins
In reply to: [Google Authenticator] Critical vulnerability in Multisite installationsI’ve never had a multisite installation running, does the workaround from the Duo people also work with my plugin ?
“In the meantime, as the advisory states, we have recommended a workaround for WordPress Multisite deployments: enable duo_wordpress globally, and disable it for specific user roles.”Best regards
Henrik SchackForum: Plugins
In reply to: [Google Authenticator] Dashboard Login Error Using Google AuthenticatorI’m not doing anything right now, I could try to assist you on/via Skype if you want ?
Best regards
Henrik SchackForum: Plugins
In reply to: [Google Authenticator] Dashboard Login Error Using Google AuthenticatorIn case you don’t have access to the serverlog you could try this:
Add the following to the beginning of wp-config.php
define( ‘WP_DEBUG’, true );
define(‘WP_DEBUG_LOG’, true);Make things fail a couple of times, then FTP download the wp-content/debug.log file
Best regards
Henrik Schack