Top all-time · #19518
Cyrozap's Tech Projects
Personal blog · cyrozap.comsecurityprogramming
Cyrozap's Tech Projects is a personal blog at cyrozap.com about security and programming. Since 2017, 4 different Hacker News readers have linked it 5 times, most often “Reversing the Symantec VIP Access Provisioning Protocol”. The last post was in 2015, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link this post for its reverse-engineering of Symantec VIP's authentication system, explaining how its tokens can be used with standard TOTP apps like Google Authenticator and FreeOTP.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Reversing the Symantec VIP Access Provisioning Protocol4 people · 5 mentions · first linked 2017-11-14
What Hacker News says?
Symantec's system does suck but there's actually a way to use it with Google Authenticator: https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi...
Comment linking /2014/09/29/reversing-the-symantec-vip-access-provisioning-protocol/
on “Quora User Data Compromised”Submitted Reversing the Symantec VIP Access Provisioning Protocol as a story · 1 points
HN discussionThis blog post explains how it works: https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi... But yes, the original author extracted a pair of shared secrets from the Symantec executable.
Comment linking /2014/09/29/reversing-the-symantec-vip-access-provisioning-protocol/
on “Saudis suspected of phone spying campaign in US”This repository contains the software required to generate the TOTP URL from the info PayPal provides to you, as well as the site you need to get to: https://github.com/claudiodekker/symantec-vip-otp-generator And a blogpost explaining the backstory: https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi...
Comment linking /2014/09/29/reversing-the-symantec-vip-access-provisioning-protocol/
on “FreeOTP – An open-source solution for authentication soft tokens”Never interacted with Symantec’s system and thought it was one of the rare non-standard exceptions, but apparently it’s just normal TOTP with extra funky lock-in at the enrolment stage[1,2]. [1] https://www.cyrozap.com/2014/09/29/reversing-the-symantec-vi... (expired cert warning) [2] https://github.com/dlenski/python-vipaccess
Comment linking /2014/09/29/reversing-the-symantec-vip-access-provisioning-protocol/
on “TOTP for 2FA is incredibly easy to implement. So what's your excuse?”
