{"action":"created","issue":{"url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5","labels_url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5/comments","events_url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5/events","html_url":"https://github.com/Yubico/php-u2flib-server/issues/5","id":47203877,"number":5,"title":"Security: Improper handling of U2F counters.","user":{"login":"StormTide","id":819357,"avatar_url":"https://avatars.githubusercontent.com/u/819357?v=3","gravatar_id":"","url":"https://api.github.com/users/StormTide","html_url":"https://github.com/StormTide","followers_url":"https://api.github.com/users/StormTide/followers","following_url":"https://api.github.com/users/StormTide/following{/other_user}","gists_url":"https://api.github.com/users/StormTide/gists{/gist_id}","starred_url":"https://api.github.com/users/StormTide/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StormTide/subscriptions","organizations_url":"https://api.github.com/users/StormTide/orgs","repos_url":"https://api.github.com/users/StormTide/repos","events_url":"https://api.github.com/users/StormTide/events{/privacy}","received_events_url":"https://api.github.com/users/StormTide/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2014-10-29T21:08:13Z","updated_at":"2015-01-11T22:36:14Z","closed_at":null,"body":"The reference applications incorrectly handle a rolled back counter -- needs to disable the login on valid signature with a rolled back counter to prevent security failures. Current model allows for counter iteration, defeating the security of the counter.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/comments/69515339","html_url":"https://github.com/Yubico/php-u2flib-server/issues/5#issuecomment-69515339","issue_url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5","id":69515339,"user":{"login":"StormTide","id":819357,"avatar_url":"https://avatars.githubusercontent.com/u/819357?v=3","gravatar_id":"","url":"https://api.github.com/users/StormTide","html_url":"https://github.com/StormTide","followers_url":"https://api.github.com/users/StormTide/followers","following_url":"https://api.github.com/users/StormTide/following{/other_user}","gists_url":"https://api.github.com/users/StormTide/gists{/gist_id}","starred_url":"https://api.github.com/users/StormTide/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StormTide/subscriptions","organizations_url":"https://api.github.com/users/StormTide/orgs","repos_url":"https://api.github.com/users/StormTide/repos","events_url":"https://api.github.com/users/StormTide/events{/privacy}","received_events_url":"https://api.github.com/users/StormTide/received_events","type":"User","site_admin":false},"created_at":"2015-01-11T22:36:14Z","updated_at":"2015-01-11T22:36:14Z","body":"The attack scenario for token cloning is the classical temporary access to longterm access... the ol 'at a border', industrial espionage ala apt, etc... its rarely just to gain access as you can pull that off by simple theft or other local system attacks.  What we're talking about here is defeating some sort of supply-chain interdiction, apt, etc.. Thats why these counter exist, to prevent two tokens from co-existing.\r\n\r\nI think the library has to re-evaluate the in/out here. What is it trying to provide? If its an implementation for U2F, then that really has to include metadata tracking and security event notification and token lockout, beyond that of a 'please watch for err_too_low' doccomment, because we all know how PHP developers stop coding at 'it works'."}}