A complete bypass of eMudhra’s 1FA OTP login system

Oh man, good that they are leaving the CA business.

https://news.ycombinator.com/item?id=50195110

The anti AI scraping on this site doesn't work that well. I'm being served non-sense text about buttplugs. I'm human, I swear.

The number the tool found was 1861. The e-mailed OTP code was 1858. What am I missing?

So basically anyone who used this CA is screwed if someone knows your email?

I understand it in the following way:

They put the public key into js and encrypt the body of the request. This is common practice to protect users' important data from being accessed by a proxy (in this case, Cloudflare) and is ok.

But the real bug is that they don't rate-limit, invalidate, or protect the endpoint related to OTP checks, so it can be brute-forced, as the search space is limited.

Could someone explain this? Does this mean that it enables logging in as any account in emudhras infra?

Security represents less than 1% of their business.

Don't piss off the internet, there will be consequences. I guess.

Damn, these Mastodon accounts are a rabbit hole to get lost in

This site serves me garbage. Iocaine, I think? I use Brave.

"If you are not [a bot], and you feel you have been served garbage by mistake, please contact the owner of the site you're visiting."

If anyone knows another way to access the content, I'd be interested. No contact details are offered and visiting mastodon.catgirl.cloud resets my connection.

Hahahahha what a roast. Too funny, especially the "4 Bars" in the background of the demo.

"S" in "eMudhra stands for "Secure".

Please can this not be true..

[flagged]