DUO - MFA

[Cantor, Scott]

On 8/4/14, 9:56 AM, "Bryan E. Wooten" <bryan.wooten at utah.edu> wrote:

>This is a little off topic but I thought the list could help.
> 
>We are working to put DUO MFA into CAS using DUO¹s java code. It would
>really help our build process
>If DOU would put binaries in a central maven repository.
> 
>An issue has be created:
>duosecurity/duo_java#1 <https://github.com/duosecurity/duo_java/issues/1>
> 
>Please add your comments if you think this would be of benefit to Shib
>MFA build processes.

Just from the perspective of the project, no, it wouldn't. Maven does not
provide a mechanism to validate the authenticity of artifacts it uses in a
build, so using any repository you don't control is a significant security
bug while building software.

It's one thing to do a bad job of authenticating artifacts initially
(that's almost implied, we just don't have much to go on with so few
artifacts signed by trustworthy keys), but building software such that you
repeatedly pull in untrusted code is mind boggling.

-- Scott