Re: Two-factor auth for Bugzilla

2011-02-06 Thread Ian G
On 7/02/11 2:38 AM, Florian Weimer wrote: * Gervase Markham: Goal: fix bug 570252. Provide 2-factor authentication for some Bugzilla accounts. https://bugzilla.mozilla.org/show_bug.cgi?id=570252 The IP address restriction is a pretty strong factor. Basically, it means that a potential attack

Re: Two-factor auth for Bugzilla

2011-02-06 Thread Eddy Nigg
On 02/06/2011 05:38 PM, From Florian Weimer: The IP address restriction is a pretty strong factor. Florian, tell me what your IP is and I'll log into Bugzilla next time with that IP. Getting to know your IP is fairly easy too. -- Regards Signer: Eddy Nigg, StartCom Ltd. XMPP:start...@s

Re: TLS server keys in DNS: client policy proposal

2011-02-06 Thread Eddy Nigg
On 02/06/2011 07:11 PM, From Zack Weinberg: I'm going to ask you the same question I asked Nelson: In a hypothetical world where DNSSEC+TLSA completely supersedes DV (but people still use OV/EV for high-value sites) what do you see as having been lost? Or, turning it around, what value do you

Re: Two-factor auth for Bugzilla

2011-02-06 Thread Florian Weimer
* Marsh Ray: > My personal opinion is that IP source addresses are not actually a > particularly strong factor. Here are some reasons: It really depends on what you're dealing with. Mozilla shouldn't disclose that to the general public, so it's difficult to make good recommendations. >> As a re

Re: TLS server keys in DNS: client policy proposal

2011-02-06 Thread Zack Weinberg
On 02/05/2011 02:55 PM, Eddy Nigg wrote: However probably the optimal approach will be CA issued certs in DNS that also make use of DNSSEC to validate the former (DV). Eventually I believe that this will emerge as the real improvement and most useful approach for software vendors and CAs alike -

Re: Two-factor auth for Bugzilla

2011-02-06 Thread Marsh Ray
On 02/06/2011 09:38 AM, Florian Weimer wrote: The IP address restriction is a pretty strong factor. Basically, it means that a potential attacker would have to compromise a device quite close to the user (possible the terminal itself). We end up in a deep discussion about this every few weeks

Re: Two-factor auth for Bugzilla

2011-02-06 Thread Florian Weimer
* Gervase Markham: > Goal: fix bug 570252. Provide 2-factor authentication for some > Bugzilla accounts. > https://bugzilla.mozilla.org/show_bug.cgi?id=570252 The IP address restriction is a pretty strong factor. Basically, it means that a potential attacker would have to compromise a device qui