Would you allow this to happen?

F

FlashSA

Honorary Master
Joined
Oct 19, 2007
Messages
10,898
Reaction score
3,026
So a supplier used to have an online catalog whereby we identify the windscreen part we need and then email them the order.

Now they have decided to change this and have created some new website but in order to grant customers access, they have a guy in JHB who called us and wanted remote access to install a digital certificate so that the website approves access.

Now this doesn't seem right and my spidey senses are tingling. I ask him why can't we be emailed the certificate and he says it has a unique unlock password which they won't divulge. I never let ANYONE remote into our network.

So to summarise, a random phone call from someone we have never met states he represents our supplier and wants access to all the pc's in our office network to install something to allow website access to the parts catalog.

What would you say to him?
 
Doesn't really matter what you say to him, speak with the supplier who is apparently happy to have such a broken system implemented..
 
FNB also has some business sites that need a cert installed to access, but they just mail you the cert and password to do it yourself.
 
Why doesnt the supplier allow ordering via the online catalogue.

Also I would tell them to take a hike on their "solution". I havent worked on PKI for sometime, but I cannot think of a valid reason they would need to install a certificate with a password or what exactly they are distributing.
If they install the cert or copy the keys over, they are over.

Its all kind of weird and there are certainly better ways to do this
 
irBosOtter said:
FNB also has some business sites that need a cert installed to access, but they just mail you the cert and password to do it yourself.
Click to expand...
Interesting. He referenced banks and said they also need certificates (which I know) but he was alluding to banks also requiring remote access. Of course I called BS because that would mean a bank asking for something they tell you never to allow!
 
I would assume your supplier now has a mTLS setup in his new website/system, where only clients who hold the corresponding public key/certificate are allowed access into the system.

This is not a strange setup for many of the larger system where access control is required, but seems strange for a "Windscreen supplier", an OAuth setup with client username/password would be more efficient.

Delivering of key/certificate is usually treated as extremely confidential, and there are various ways to delivery this in a secured manner, but email is unfortunately not one of it. Also, if they installed the certificate in one of your system, that particular system will be the only system that is allowed access.

Pretty weird setup it seems...
 
KevOfGoodHope said:
I would assume your supplier now has a mTLS setup in his new website/system, where only clients who hold the corresponding public key/certificate are allowed access into the system.

This is not a strange setup for many of the larger system where access control is required, but seems strange for a "Windscreen supplier", an OAuth setup with client username/password would be more efficient.

Delivering of key/certificate is usually treated as extremely confidential, and there are various ways to delivery this in a secured manner, but email is unfortunately not one of it. Also, if they installed the certificate in one of your system, that particular system will be the only system that is allowed access.

Pretty weird setup it seems...
Click to expand...
So our main supplier, Shatterprufe SA, do their online site differently (and correctly in my view) - We have unique usernames and passwords with OTP's. Works well, credentials can't be shared out because only 1 session per username is allowed and the OTP secures everything.

This other supplier is being stupid and I refuse to oblige...
 
It doesnt make any sense to me. If it is a cert used to authenticate (mutual TLS or any applicative auth) then surely the cert's private key would have to be generated and protected by the client, AKA you? They can sign the cert (you send them the CSR), but they can't hold the private key, it defeats the object of the exercise.

Even if this is legit, it sounds like a pretty piiss poor implementation to me.
 
FlashSA said:
So our main supplier, Shatterprufe SA, do their online site differently (and correctly in my view) - We have unique usernames and passwords with OTP's. Works well, credentials can't be shared out because only 1 session per username is allowed and the OTP secures everything.

This other supplier is being stupid and I refuse to oblige...
Click to expand...

Its a freaken supplier of mostly non essential stuff. What is the reason for all this top secret espionage login setups ?

This is so crazy for basically just a pricelist.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X