Differences

This shows you the differences between two versions of the page.

--- projects:sso [2025/07/09 16:33] – Magic link code samp20
+++ projects:sso [2025/07/11 12:51] (current) – samp20
@@ Line 26: / Line 26: @@
 ==== Keyfob/card login ====
-This will be a slight change to our current login method, requiring you to enter your email first before scanning your keyfob/card. This is because the keyfobs aren't particularly secure and could be easily cloned. By treating them more like a PIN we can disable keyfob login after so many attempts for that member.
+This will be a slight change to our current login method, requiring you to enter your email first before scanning your keyfob/card. This is because the keyfobs aren't particularly secure and could be easily cloned. By treating them more like a PIN we can disable keyfob login after so many attempts for that member. Without this any attacks would be a lot easier due to the [[https://en.wikipedia.org/wiki/Birthday_problem|Birthday Paradox]].
 An additional security measure will be required to ensure these keyfob logins only come from the Hackspace network. For now an IP allowlist should be sufficient, along with a global lockout if a significant number of keyfob login attempts are spotted. It is recognised that IP addresses can theoretically be spoofed, but quite difficult in practice. The global lockout would be a nuclear countermeasure in the extremely rare instance someone does figure this out.