Notices by FenTiger (fentiger@zotum.net), page 2

Embed this notice
FenTiger (fentiger@zotum.net)'s status on Sunday, 11-Aug-2024 19:04:01 JST FenTiger
Anyone interested in single sign-on / #SSO? Want a new toy to play with? I've been experimenting with it recently, and now I've got something to share: an experimental demo of how a "Sign in with the Fediverse" mechanism might work.

If you have a Mastodon or Hubzilla account, or an IndieAuth-style self-hosted identity, I'd like to invite you to try and sign in to my test site at login.mythik.co.uk.

Headline features:
- User authentication/authorization based on the Ory tools.
- Supports signing in using an existing Fediverse (or other) account - or one you host yourself
- Open source - well, not yet, but it could be, if people are interested in it
- Written by a non-expert! Woefully insecure! All manner of attacks, just waiting to be found! Invite your security expert friends to the party, and laugh together at the n00b! Fun for all the family!
Supported identity providers include:
- Mastodon (must be a recent version that includes this pull request). mastodon.social is known to work.
- Hubzilla (any version). zotum.net is known to work.
- #IndieAuth / #FedCM
- Another instance of itself, using OpenID Connect
(There's a chance Streams might work, too.)

Protocols supported:
- #OIDC Discovery
- Client ID Metadata Document
- FedCM for IndieAuth
- #OpenWebAuth
- A method using the Mastodon API
- Classic (non-FedCM) IndieAuth (if you're lucky; I found this very hard to test, and had various problems with it)
- My original experiments used Dynamic Client Registration but I've moved away from this.
If you can get it to work - share a screenshot and let me know what you think!

(I'll try to keep this running for a while, but I can't guarantee it - partly because I haven't finished trying to attack it yet. If I have to take it down for some reason, I'll edit this post to say so.)
In conversation Sunday, 11-Aug-2024 19:04:01 JST from zotum.net permalink
Attachments
1. No result found on File_thumbnail lookup.
  
  Zotum
2. Domain not in remote thumbnail source whitelist: login.mythik.co.uk
  
  Login
Embed this notice
FenTiger (fentiger@zotum.net)'s status on Friday, 12-Apr-2024 10:50:53 JST FenTiger
in reply to
- silverpill
@silverpill What's the purpose of the did: and key: prefixes at this point? Can they be removed?

It might be a good idea to have something there that can differentiate newer versions of the scheme - but if did: in particular can go, people might be less likely to associate this with all the dodgy bl*ckch*ain stuff.

In conversation Friday, 12-Apr-2024 10:50:53 JST from zotum.net permalink
Embed this notice
FenTiger (fentiger@zotum.net)'s status on Saturday, 16-Mar-2024 20:27:55 JST FenTiger

@Helge Your suggestion of did://key:1234567/path would have the upside of being compatible with Go's url.String() function, which also turns out to be unable to process did: URLs with paths.

My #BangHeadHere sign is taking a bit of a battering today...

In conversation Saturday, 16-Mar-2024 20:27:55 JST from zotum.net permalink
Embed this notice
FenTiger (fentiger@zotum.net)'s status on Saturday, 09-Mar-2024 20:06:16 JST FenTiger

Oh, joy: it turns out that Go's net/url package doesn't understand that DID URLs can have paths.

Parsing "https://example.social/path/to/object" gives me a useful result:

&url.URL{
    Scheme:"https",
    Opaque:"",
    Host:"example.social",
    Path:"/path/to/object",
    [...]
}But parsing "did:ap: key:z6abcdef/path/to/object" gives me this:

&url.URL{
    Scheme:"did",
    Opaque:"ap🔑z6abcdef/path/to/object",
    Host:"",
    Path:"",
    [...]
}So I need some kind of wrapper to detect DID URLs and parse the paths out of them. That's easy enough, I suppose, but then I need to actually use that wrapper, in all the relevant places...

#ActivityPub #FediDev #BangHeadHere
In conversation Saturday, 09-Mar-2024 20:06:16 JST from zotum.net permalink
Attachments
1. Untitled attachment
Embed this notice
FenTiger (fentiger@zotum.net)'s status on Monday, 26-Feb-2024 20:56:18 JST FenTiger
in reply to

Is the apresolver endpoint expected to work?

I tried https://mitra.social/.well-known/apresolver/did:ap: key:z6MkuXdkTDa1iAZraZCRT9N5BpXKZxvBYpR4T7EG4tTxYuda/actor, and got a 200, but it's a HTML page, not the actor object. I don't see a Link header, either.

(Space inserted so Hubzilla doesn't convert "key" into a 🔑 emoji!)
In conversation Monday, 26-Feb-2024 20:56:18 JST from zotum.net permalink
Attachments
1. No result found on File_thumbnail lookup.
  
  Mitra | Federated social network
  
  Federated social network
Embed this notice
FenTiger (fentiger@zotum.net)'s status on Tuesday, 30-Jan-2024 00:41:01 JST FenTiger

For a while now I've been meaning to take a look at #OpenWebAuth, but I've been a bit daunted by the reverse engineering effort that it would take.

This changed when I came across this page:

   #^https://hz.eenoog.org/wiki/pascal/Fediverse(28)20(29)OpenWebAuth(28)20(29)support/Home

This links to three PRs adding OpenWebAuth to Mastodon and PixelFed. Reading these PRs saved me a lot of time by clearly highlighting the areas of the code which I needed to study. With these and a bit of grepping I've been able to implement most of #OpenWebAuth locally, so that my toy instance can now log me into Hubzilla, and I can very nearly allow Hubzilla users to log in to me, too.

Here's a quick writeup of how it works, in the "happy case". I'm wondering if it's worth polishing this further and making it into a #FEP.

1. The OpenWebAuth flow can begin in one of two ways:

  (a) The user visits the target instance and sees a login screen.  They type their Fediverse ID into a form field and click "Login".

  (b) The user follows a link to the target instance. This link has a query parameter, zid=, which specifies the user's Fediverse ID.

Either way, the target instance has learned the user's ID, but has not verified it yet.

2. The target instance constructs a URL of the form

   https://home-instance.example/magic?owa=1&bdest=<destination URL>

The parts of this URL are:

   Scheme: Must be HTTPS
   Hostname: The same as the hostname portion of the user's ID
   Path: Must be /magic
   Query parameters:
      owa: must be set to 1
      bdest: The URL that the user is trying to visit. This is encoded as UTF-8 and then converted to a hexadecimal string.

The user's browser is redirected to this URL.

3. The /magic endpoint at the user's home instance decodes the bdest destination URL. It performs a webfinger lookup on the root URL of the destination site and looks for a link with rel set to http://purl.org/openwebauth/v1. This identifies the target instance's token endpoint.

The home instance constructs and issues a signed HTTPS request to this endpoint.  This request must have an Authorization header starting with the word Signature followed by the encoded HTTP signature. The keyId property of the signature points to the public key in the user's actor record, just as for ActivityPub signed requests.

4. The target instance's "token" endpoint extracts the "keyId", fetches the actor record, extracts the public key and verifies the signature.

On success, it generates an URL-safe random string to use as a token.  This token is stored locally, associated with the actor who signed the message. The token is also encrypted using the actor's public key and the RSA PKCS #1 v1.5 encryption scheme. The encrypted result is encoded as URL-safe Base64 with no '=' padding bytes.

Next it constructs the following JSON object in response:

   {
       "success": true,
       "encrypted_token": <the base64-encoded token>
   }
On failure it can also return a result with success set to false.

5. The signed request issued by the /magic endpoint completes.  The home instance decodes the JSON response and verifies that success is true. Next it decodes the Base64-encoded encrypted token and decrypts it using the actor's private key.

If successful, it takes the original bdest destination URL, adds the query parameter: owt=<decrypted token>, and redirects the user's browser to it.

6. The user arrives at their destination URL. The target instance sees the owt= query parameter and checks its local storage for the token which it saved in step 4.

If found, this token contains the user's verified identity, and the target instance logs them in, overriding any existing login they may have. The token is also deleted from local storage so that it cannot be redeemed more than once.
In conversation Tuesday, 30-Jan-2024 00:41:01 JST from zotum.net permalink
Attachments
1. Untitled attachment
2. Domain not in remote thumbnail source whitelist: hubzilla.org
  
  Hubzilla - info@hubzilla.org

Public

Notices by FenTiger (fentiger@zotum.net), page 2

User actions

Following 0

Followers 0

Groups 0

Statistics

Feeds