Coming 02/11 to our Website: Two-Factor Authentication, Argon2 Hashing
At System76, we pride ourselves on making computers by nerds, for nerds. Our dedicated group of engineers work hard to create the best solutions for like-minded professionals, including on our website.
Today, we’re happy to announce new security updates for all system76.com accounts in the form of Recognizer, our open source authenticator service. The most notable changes this tool brings are the introduction of two-factor authentication and an upgrade in password hashing to further protect your login credentials. These updates, releasing this Thursday (February 11th 2021), will substantially increase security and make our site more flexible as we grow. Once the update is released, all users will be required to reset their password.
Two-Factor Authentication
Setting up two-factor authentication protects your account in the event that someone gets ahold of your login credentials. Beginning Thursday, February 11th, you can turn on 2FA by signing in to your system76.com account. From there, go to the Account Details page, where you’ll find the Two-Factor Authentication section. Follow the instructions to link your account with your third-party authentication app, such as Google Authenticator or 1Password.
Under the hood, System76 uses the Erlang ‘pot’ library, which generates RFC 6238 time based one-time tokens compatible with these third-party apps. Our authentication system also uses OAuth2.0 and JSON Web Token (JWT), two secure industry standards for authorization flows and communication between systems. The use of OAuth2.0 opens up the door for the potential to sign in with a third party, or even Pop!_OS, using a “Log In with System76” button; though for now, it’s only being used with System76 projects.
Password Hashing
Another piece within Recognizer is the migration to Argon2 password hashing. In addition to sounding delicious, password hashing is a secure way to store passwords for when you want to access your account at login. Passwords are transformed into a long string of characters that cannot be converted back to your actual password. A “salt” is added for further security, which adds a random set of characters to your password hash. This ensures your password is linked solely to your account, even in the event that another account uses the same password as you. Lastly, we increased our password requirements to include a minimum character length, special characters, capital letters, and numbers.
While your passwords have always been stored safely, we’re taking this opportunity to move to a newer and stronger algorithm. We chose Argon2 for its modern hashing technique and resilience to new attack methods. It also has a standard format for storing the hash, salt, and parameters as a single string, making it easy to change hashing options in the future without having to force a password reset. However, because existing passwords are currently hashed using an alternative algorithm, all existing users will need to reset their passwords to migrate their accounts over to this new algorithm on Thursday, February 11th.
Open Source Security Measures
System76 has always led by example with open source solutions. So far, we’ve open sourced our Protobuf messages, our notification microservice, and our Zendesk integration. The newest addition, Recognizer, is written in Elixir, styled in Bulma, and released under a GPLv3 license.
Open source tools have the advantage of being audited by independent developers, resulting in a stronger solution. By open sourcing security, companies can provide the most secure experience for their users and better address any vulnerabilities that may arise.
