{"action":"created","issue":{"url":"https://api.github.com/repos/authy/authy-devise/issues/58","repository_url":"https://api.github.com/repos/authy/authy-devise","labels_url":"https://api.github.com/repos/authy/authy-devise/issues/58/labels{/name}","comments_url":"https://api.github.com/repos/authy/authy-devise/issues/58/comments","events_url":"https://api.github.com/repos/authy/authy-devise/issues/58/events","html_url":"https://github.com/authy/authy-devise/issues/58","id":158987659,"number":58,"title":"remember_device not account specific","user":{"login":"Gasparila","id":8882905,"avatar_url":"https://avatars.githubusercontent.com/u/8882905?v=3","gravatar_id":"","url":"https://api.github.com/users/Gasparila","html_url":"https://github.com/Gasparila","followers_url":"https://api.github.com/users/Gasparila/followers","following_url":"https://api.github.com/users/Gasparila/following{/other_user}","gists_url":"https://api.github.com/users/Gasparila/gists{/gist_id}","starred_url":"https://api.github.com/users/Gasparila/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gasparila/subscriptions","organizations_url":"https://api.github.com/users/Gasparila/orgs","repos_url":"https://api.github.com/users/Gasparila/repos","events_url":"https://api.github.com/users/Gasparila/events{/privacy}","received_events_url":"https://api.github.com/users/Gasparila/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-06-07T18:07:10Z","updated_at":"2016-06-09T23:21:18Z","closed_at":null,"body":"Looking at https://github.com/authy/authy-devise/blob/f3fd125f1b8c9539a1a700d3198628cf4fe332cd/lib/devise-authy/controllers/helpers.rb#L12, the remember_device cookie has no link to the current account. This makes it trivial for any attacker to bypass two-factor authentication for a compromised account, rendering authy useless:\r\n\r\n1. Attacker logs into their account with their username and password and two-factor authentication (this will give the attacker a valid remember_device cookie)\r\n2. Attacker logs out\r\n3. Attacker logs in to compromised account. Since the cookie is still set, require_token? will return false"},"comment":{"url":"https://api.github.com/repos/authy/authy-devise/issues/comments/225055266","html_url":"https://github.com/authy/authy-devise/issues/58#issuecomment-225055266","issue_url":"https://api.github.com/repos/authy/authy-devise/issues/58","id":225055266,"user":{"login":"Gasparila","id":8882905,"avatar_url":"https://avatars.githubusercontent.com/u/8882905?v=3","gravatar_id":"","url":"https://api.github.com/users/Gasparila","html_url":"https://github.com/Gasparila","followers_url":"https://api.github.com/users/Gasparila/followers","following_url":"https://api.github.com/users/Gasparila/following{/other_user}","gists_url":"https://api.github.com/users/Gasparila/gists{/gist_id}","starred_url":"https://api.github.com/users/Gasparila/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Gasparila/subscriptions","organizations_url":"https://api.github.com/users/Gasparila/orgs","repos_url":"https://api.github.com/users/Gasparila/repos","events_url":"https://api.github.com/users/Gasparila/events{/privacy}","received_events_url":"https://api.github.com/users/Gasparila/received_events","type":"User","site_admin":false},"created_at":"2016-06-09T23:21:18Z","updated_at":"2016-06-09T23:21:18Z","body":"Opened a PR to get this issue fixed as quickly as possible"}}
{"actor":{"display_login":"Gasparila"}}