Hi Paul! I believe your token should automatically resync if you enter three consecutive correct passcodes that are outside (but forward of) the current valid window.
I think that's a fair read. The primary use of that data is for security use cases. Eg. if you're coming from an out-of-date browser or have risky Java/Flash plugin versions, we can notify you to update/remediate.
Another way to look at it: We collect security-relevant information on your device, but not your _personal_ data. In other words, we don't collect your email, photos, contacts, user-generated data, etc.
It might be worth pinging your IT/security dept to ask about enabling Duo Push as an option or to change the policy for SMS passcodes (eg. you can just have one passcode sent instead of ten).
If anyone can quickly point me at the CM9 kernel source, I can verify whether or not this is actually patched.
The vulnerability is looking checking to see if the mem_write() function is functional (where the vulnerability was present), which was removed/disabled by upstream AOSP.
We'd love to be able to publish it in the Play Store, but we were informed by Google that the terms of service disallow any apps that check for vulnerabilities, despite X-Ray's good intentions.
It's a weird distinction that they allow AV-like apps, but not vulnerability assessment apps.
Another variation of that attack is still unpatched, allowing any app to invoke INSTALL_ASSET. Certainly that's not intended functionality and is a bug that will be (eventually) patched, but I wouldn't classify it as FUD.
Yeah, mempodroid is a great example. You'd need to randomize the location of the setuid executable (w/PIE), randomize of the linker, and implement something like GRKERNSEC_BRUTE to prevent trivial local bruteforcing of a usable address.
Speaking of which, spender's recent blog post gives a good overview of some of the grsec/PaX mitigations that would hamper the exploitation of the /proc/pid/mem vuln:
Duo offers a number of features above and beyond Google Authenticator:
- more flexibility in choice of authentication method (voice, SMS, soft token, hard token, Duo Push)
- more supported mobile platforms (Android, iPhone, Blackberry, WinMo, Palm WebOS, Symbian, J2ME)
- more integrations (VPNs, UNIX logins, web apps, etc)
Not to mention all the features that come along with being a fully-fledged authentication service such as account management, fraud alerting, logging, etc. Feel free to give it a shot and decide for yourself. :-)
Disclaimer: if it's not obvious from my gushing, I'm affiliated with Duo. ;-)
Check out the login_duo(8) man page. You can specify a failmode configuration option to fail safe (allow access) or fail secure (deny access) if there is a connectivity loss between your servers and Duo's service.