Re: Registry lock - two-factor or intervention

On Sat, 2013-09-21 at 08:22 +0200, Jan Saell wrote:

> Here at iis we are have the registry lock implemented as a manual option
> (pricey) and is in the process of developing an automatic registry lock
> function.

For interests sake, this weekend I devoted time to enhance security on
my web based Registrar System. I added both Access-Control-Lists and an
One-Time-Password system to supplement the normal security of Usernames
and Passwords. The ACL is probably similar to what most EPP systems
implement. Its managed by the customer (Reseller/Registrant), basically
a simple string containing multiple CIDR-ed IPv4/6 addresses. The OTP
coding ideas came from http://motp.sourceforge.net and is currently used
to gain access to the website when one is denied access by the ACL
system. Works just fine. Cost a day of development. I also have a
generic application that creates OTP's on my Android mobile device which
allows me access to my Registrar System. Now to convince my customers to
use it! For OTP, they need to add and manage a 20 character seed and a 4
digit Pin.

It would be simple to demand an OTP in order to switch off some sort of
lock.
-- 
  .  .     ___. .__      Posix Systems - (South) Africa
 /| /|       / /__       [email protected]  -  Mark J Elkins, Cisco CCIE
/ |/ |ARK \_/ /__ LKINS  Tel: +27 12 807 0590  Cell: +27 82 601 0496

_______________________________________________
provreg mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/provreg