{"action":"created","issue":{"url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5","labels_url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5/comments","events_url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5/events","html_url":"https://github.com/Yubico/php-u2flib-server/issues/5","id":47203877,"number":5,"title":"Security: Improper handling of U2F counters.","user":{"login":"StormTide","id":819357,"avatar_url":"https://avatars.githubusercontent.com/u/819357?v=3","gravatar_id":"","url":"https://api.github.com/users/StormTide","html_url":"https://github.com/StormTide","followers_url":"https://api.github.com/users/StormTide/followers","following_url":"https://api.github.com/users/StormTide/following{/other_user}","gists_url":"https://api.github.com/users/StormTide/gists{/gist_id}","starred_url":"https://api.github.com/users/StormTide/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StormTide/subscriptions","organizations_url":"https://api.github.com/users/StormTide/orgs","repos_url":"https://api.github.com/users/StormTide/repos","events_url":"https://api.github.com/users/StormTide/events{/privacy}","received_events_url":"https://api.github.com/users/StormTide/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":20,"created_at":"2014-10-29T21:08:13Z","updated_at":"2015-01-11T23:34:39Z","closed_at":null,"body":"The reference applications incorrectly handle a rolled back counter -- needs to disable the login on valid signature with a rolled back counter to prevent security failures. Current model allows for counter iteration, defeating the security of the counter.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/comments/69517688","html_url":"https://github.com/Yubico/php-u2flib-server/issues/5#issuecomment-69517688","issue_url":"https://api.github.com/repos/Yubico/php-u2flib-server/issues/5","id":69517688,"user":{"login":"StormTide","id":819357,"avatar_url":"https://avatars.githubusercontent.com/u/819357?v=3","gravatar_id":"","url":"https://api.github.com/users/StormTide","html_url":"https://github.com/StormTide","followers_url":"https://api.github.com/users/StormTide/followers","following_url":"https://api.github.com/users/StormTide/following{/other_user}","gists_url":"https://api.github.com/users/StormTide/gists{/gist_id}","starred_url":"https://api.github.com/users/StormTide/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/StormTide/subscriptions","organizations_url":"https://api.github.com/users/StormTide/orgs","repos_url":"https://api.github.com/users/StormTide/repos","events_url":"https://api.github.com/users/StormTide/events{/privacy}","received_events_url":"https://api.github.com/users/StormTide/received_events","type":"User","site_admin":false},"created_at":"2015-01-11T23:34:39Z","updated_at":"2015-01-11T23:34:39Z","body":"If you leave it up to the implementer, and outside the lib, you're basically trying to require everyone using U2F to be an expert in this stuff, to understand things like counters and their purposes. That doesn't make sense to me. Better that the lib provide clear input/output patterns that encapsulate the full responsibility of the spec/token."}}