- ripe-atlas - mailman.ripe.net

Fwd: 2FA
by Ernst J. Oud 27 Mar '24

27 Mar '24

L.S. Oh well, I installed the Authenticator Chrome Extension (https://chromewebstore.google.com/detail/authenticator/bhghoamapcdpbohphigo…) on my PC which could scan (nifty!) the QR code exported from Google Authenticator. All is fine now. Can use 2FA via Chrome on my PC. Regards, Ernst > From: "Ernst J. Oud" <ernstoud(a)gmail.com> > Date: 25 March 2024 at 13:39:45 CET > To: Bogdan-Stefan Rotariu <bogdan(a)rotariu.ro> > Subject: Re: [atlas] 2FA > > Bogdan-Stefan, > > I agree with your remark about the fact that 2FA using an Authenticator on the same system used for the login defeats its purpose. > > However, RIPE refers on the 2FA instruction page (https://www.ripe.net/membership/member-support/ripe-ncc-access/two-step-ver…) under the heading “What if I don't have or want to use a smartphone?” to the OATH Toolkit for Linux. > > Thus, if I accept the risk that my PC could be hacked and RIPE clearly also accepts running 2FA on a PC running Linux then I reckon that running a 2FA Authenticator on Windows or even macOS should also be made possible. > > I therefore stand by my question how to enable an Authenticator on a PC if already enabled on another device. More than 95% of users don’t use Linux on their desktop. Then only referring to an arcane Linux CLI tool is a bit limiting. > > I installed that toolkit on WSL2 on my PC and it installed fine but to use it I still need the secret key that was used to enable 2FA. Which I don’t have and is also not available on my profile page. Tried exporting it in Google Authenticator which gives a QR code, pointed WinAuth to the URL where I stored it. Didn’t work. > > Regards, > > Ernst J. Oud > >>> On 25 Mar 2024, at 12:40, Bogdan-Stefan Rotariu <bogdan(a)rotariu.ro> wrote: >>> >> Hello, >> >> The scope of 2FA is to use a secondary device to get the authorisation codes. We saw hacked PC’s that had Authy or any other 2FA Apps, and the attackers used those to obtain the codes and hijacked accounts. >> So using a 2FA App on the same device that you’re using to login and authorise at the same time defeats the purpose of the 2FA. >> >> We are try now to teach our users and employees to stop using desktop apps for 2FA code generators and I encourage you to do the same, even if it adds a second layer (as expected) of effort for you. >> >> Thanks, >> >> -- >> Bogdan-Stefan Rotariu >> >> >> >>> On 25 Mar 2024, at 13:13, Ernst J. Oud <ernstoud(a)gmail.com> wrote: >>> >>> Hi, >>> >>> I enabled 2FA for Atlas website access. Works fine on my iPad and Android phone, using the Google Authenticator. However not always I have these devices with me when I want access via my Windows PC. >>> >>> I installed WinAuth on my PC but it needs the secret key that is generated when 2FA is enabled. Is there a way to get this secret key for this purpose? Tried exporting from Google Authenticator but that only supplies a QR code, not the key. >>> >>> Is there a way to use both a tablet/phone and a PC for authentication? >>> >>> I read that in Q1 2FA will be enforced. I am a bit amazed that there has been no further announcement in this group with some help. The page on 2FA only mentions the Oauth Toolkit for Linux. No help whatsoever for Windows users. >>> >>> Any clues? >>> >>> Regards, >>> >>> Ernst J. Oud >>> -- >>> ripe-atlas mailing list >>> ripe-atlas(a)ripe.net >>> https://lists.ripe.net/mailman/listinfo/ripe-atlas >> >> -- >> ripe-atlas mailing list >> ripe-atlas(a)ripe.net >> https://lists.ripe.net/mailman/listinfo/ripe-atlas

1 1

Fwd: [ncc-announce] [News] 2FA Mandatory on RIPE NCC Access accounts
by Robert Kisteleki 26 Mar '24

26 Mar '24

Dear RIPE Atlas users, In case you're not following the official RIPE NCC communication channels: this is a heads up regarding 2FA use in RIPE Access, the single sign-on mechanism behind various RIPE NCC services including RIPE Atlas. Action needed from you: please make sure you enable 2FA on your account. Regards, Robert Kisteleki RIPE NCC -------- Forwarded Message -------- Subject: [ncc-announce] [News] 2FA Mandatory on RIPE NCC Access accounts Date: Tue, 26 Mar 2024 12:12:12 +0100 From: Felipe Victolla Silveira <fvictolla(a)ripe.net> To: ncc-announce(a)ripe.net Dear colleagues, This week, two-factor authentication (2FA) will become mandatory on RIPE NCC Access accounts. If you have not already done so, enable 2FA on your account. For accounts that do not have two-factor authentication, when you try to log in from Wednesday 27 March, you will be prompted to check your inbox and follow the instructions in the email sent to you by the RIPE NCC. Once you have enabled 2FA, you can log in as you usually would. We will continue to improve the security and usability of RIPE NCC Access accounts over the next few months. Next week, I will also publish a RIPE Labs article explaining our roadmap and main improvements planned in more detail. We welcome your feedback and suggestions on which features are the most important for you on the RIPE NCC Services Working Group (ncc-services-wg(a)ripe.net) mailing list. If you have any issues setting up 2FA on your account, please email ncc(a)ripe.net. Kind regards, Felipe Victolla Silveira Chief Technology Officer -- Click here to unsubscribe or change your email settings: https://lists.ripe.net/mailman/options/ncc-announce

1 0

2FA
by Ernst J. Oud 25 Mar '24

25 Mar '24

Hi, I enabled 2FA for Atlas website access. Works fine on my iPad and Android phone, using the Google Authenticator. However not always I have these devices with me when I want access via my Windows PC. I installed WinAuth on my PC but it needs the secret key that is generated when 2FA is enabled. Is there a way to get this secret key for this purpose? Tried exporting from Google Authenticator but that only supplies a QR code, not the key. Is there a way to use both a tablet/phone and a PC for authentication? I read that in Q1 2FA will be enforced. I am a bit amazed that there has been no further announcement in this group with some help. The page on 2FA only mentions the Oauth Toolkit for Linux. No help whatsoever for Windows users. Any clues? Regards, Ernst J. Oud

2 1

Question about TLS test
by marcelo bagnulo braun 08 Mar '24

08 Mar '24

Hi, I understand (from a previous post in this ml) that the TLS test available in the Atlas probes uses OpenSSL. Could anyone tell me the exact command used by the probe when executing the test? I was assuming it uses something like: openssl s_client -connect <target>:port Is this correct? Does it includes further options? Thanks, marcelo

2 1

Call for presentation LACNIC’s Internet Measurements WG
by Elisa 08 Mar '24

08 Mar '24

Hi all, I would like to use this mailing list to send a quick reminder about this initiative that is seeking presentations on Internet Measurements (including, but not limited to, Atlas). The Internet Measurements Working Group (IMWG) at LACNIC41 (10 May). Seeking remote/in-person presentations. Submission deadline 12 April. Instructions: https://listas.nog.lat/archives/list/imwg@listas.nog.lat/thread/KEOIK7VC7GQ… Kind regards, Elisa R&D - LACNIC

1 0

Tomhais STARTTLS: Cad a tharla?
by Niall O'Reilly 06 Mar '24

06 Mar '24

Back in December 2022, there was a proposal to support STARTTLS measurements. (https://www.ripe.net/ripe/mail/archives/ripe-atlas/2022-December/005234.html) I wonder, whether this proposal was implemented ? I've just tried using the measurement definition form (https://atlas.ripe.net/measurements/form/), where the only TLS-related option seems to need the target to be ready to receive a client hello. /Niall

2 1

IP & MAC
by Randy Bush 05 Mar '24

05 Mar '24

i have a remote probe. on the web gui, how can i see what its lan address (it is behind a soho nat) and mac are? i thought i knew how to do this, but the moon must be in klutz. thanks. randy

3 3

Retiring old ("legacy") UI pages and deprecated API calls
by Robert Kisteleki 05 Feb '24

05 Feb '24

Dear all, As part of the RIPE Atlas user interface renewal last year, we released a new measurement scheduling form and new probe and measurement lists. Since these changes the old pages were still accessible via changed URLs. By now the use of these pages all but disappeared, and we'll remove these from the UI in the coming weeks. On a similar note, we'll also remove support for the API calls that took the form /api/v2/measurements/<TYPE>/ [*]. These have been deprecated for a long time, and since the last active user moved way most queries ending up here either come from the legacy pages or from hacking attempts. [*] in fact this has effectively been an alias for /api/v2/measurements/?type=<TYPE> so no functionality is lost and it is trivial to change code that otherwise used these calls Please reach out to us if you believe the legacy pages provided some functionality you think you'll miss so we can help you. Regards, Robert

1 1

4 probes on different networks suddenly down?
by Ernst J. Oud 30 Jan '24

30 Jan '24

Hi, At noon today 4 of my probes disconnected. 1005229 61071 55795 1005072 These are on different ISP’s and one of these is in Oracle’s cloud. So this is not a problem on my side. Restarted the 61071 since that one is nearby and easily restarted since it is a hardware probe, but that does not work. Flashing red LED. What is going on? Regards, Ernst J. Oud

3 5

Atlas weather report: bad day
by Stephane Bortzmeyer 25 Jan '24

25 Jan '24

As reported by <https://atlas.ripe.net/>, indeed, measurements timeout today.

1 0