<div dir="ltr"><div>Hei igjen Thomas,</div><div><br></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Aug 12, 2022 at 3:57 PM Thomas Sødring via nikita-noark <<a href="mailto:nikita-noark@nuug.no">nikita-noark@nuug.no</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg5484572631066607533">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Interessant Ole! </div>
</div></div></blockquote><div><br></div><div>:-)</div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg5484572631066607533"><div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Jeg mistenker at det materialet det er snakk om her er på papir. Om det er snakk om 15 esker med feks minnepinner så snakker vi type Snowden nedlasting. Kanskje han kommer til å forsvare seg meg at han fjernet graderingen av innholdet mens han var president
og derfor var det helt lovlig å gjøre det! Du kan gjøre mye rart når du er konge!</div>
</div></div></blockquote><div><br></div><div><u>Aftenposten skriver på lederplass fredag 2. september 2022:</u></div><div><u><br></u></div><div><u>"USAs føderale politi (FBI) etterforsker tidligere president Donald Trump for mulige lovbrudd.</u></div><div><u><br></u></div><div><u>Trump beholdt til dels høyt graderte dokumenter etter at han flyttet ut av Det hvite hus.</u></div><div><u><br></u></div><div><u>FBI mistenker blant annet at Trump tidligere i år aktivt gjemte bort slike statshemmeligheter.</u></div><div><u><br></u></div><div><u>Denne intensjonen om å holde noe unna, kan bli juridisk avgjørende.</u></div><div><u><br></u></div><div><u>Samtidig gav Trump og hans folk nemlig inntrykk av å samarbeide med USAs nasjonalarkiv (Nara). En mengde papirer ble overlevert med beskjed om at Nara nå hadde fått "alt".</u></div><div><u><br></u></div><div><u>Under en politiaksjon i Trumps hjem i Florida i august fant FBI likevel en rekke dokumenter med høy gradering. Noen var så hemmelige at byråets agenter og Justisdepartements advokater måtte gis økt sikkerhetsklarering for å kunne lese dem."</u></div><div><u><br></u></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg5484572631066607533"><div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Kryptering av innhold i en dokumentasjonsforvaltningsystem er fortsatt noe jeg ikke støtter. Men, jeg må innrømme at jeg ikke er 100% sikker på det. </div></div></div></blockquote><div><br></div><div>Hvordan er Nikita Noark5 Core med tanke på nivåer av gradering av innhold?</div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg5484572631066607533"><div dir="ltr"><div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">Dersom dokumentasjon er kryptert så vil det ikke være mulig å søke i det (innhold, tittel osv), så det er en
annen slags bruksperspektiv på materiale enn det jeg hadde brukt feks nikita til. Men det kan være lurt å samle kryptert og ukryptert fordi da har du alt i et system.</div>
</div></div></blockquote><div><br></div><div>Sant.</div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg5484572631066607533"><div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Med kryptert materiale er du sårbar med tanke på senere lesbarhet dersom den private nøkkelen blir borte. Jeg har opplevd at arkivmateriale blir avlevert til depot uten at nøkkelen også avleveres. Jeg har hørt (men ikke fått det bekreftet) at folk krypterer
dokumentasjon med sine private BankID. Det blir spennende å se om det lar seg avlevere??? Det er kjent at folk signerer med sin private BankID i jobbsammenheng, men dette med kryptering var nytt for meg. Jeg går ut ifra at det ikke stemmer! Materialet bør
dekrypteres før det avleveres til depot. Ting som er så sensitivt (nasjonal sikkerhet) hadde jeg ikke hatt i et system som er tilgjengelig på internett. Jeg kan ikke garantere at noen ikke finner en sær hull i et eller annet bibliotek som gjør at innhold lekker.
Ingen kan garantere det!</div>
</div></div></blockquote><div><br></div><div>Hva med å ta i bruk Microsoft Authenticator og/eller Google Authenticator til autentisering i Nikita? Begge universitene mine (UiO og NTNU) krever tilgangskontroll via Authenticator og QR-kode som scannes i en mobiltelefonapplikasjon og som benyttes til å bekrefte innloggingene. Jeg tror ikke at OsloMet har implementert dette enda.</div><div><br></div><div>Det er kanskje en grunn til det, hvis en mister nøkkelen, så må en henvende seg til Authenticator kundeservice ved NTNU for å få resatt Autheticator innloggingen.</div><div><br></div><div>Fra <a href="https://oril.co/blog/two-factor-authentication-with-java-and-google-authenticator/">https://oril.co/blog/two-factor-authentication-with-java-and-google-authenticator/</a></div><div><br></div><div><div class="gmail-o-single__info-left"><div class="gmail-info-wrap">
<b class="gmail-o-single__info-author-name">Ihor Sokolyk</b>
<span class="gmail-user-position">Lead Software Engineer | Expertise : Java, FinTech, System integrations</span>
<a href="https://www.linkedin.com/in/ihor-sokolyk-822248108/" class="gmail-user-linkedin" target="_blank">Linkedin</a></div></div><div class="gmail-container">
<div class="gmail-row">
<div class="gmail-col-lg-8">
<div class="gmail-o-single__main gmail-js-single-info">
<div class="gmail-o-single__content gmail-js-single-content">
<p>I am more than sure that each of you have at least one account with
enabled Two-Factor Authentication (2FA). But if you are still unfamiliar
with 2FA I’ll give you some general explanation.</p>
<p>It’s a second step in login sequence that asks you to enter 6-digits
code sent to you by email, text message or Google Authenticator app and
this code expires in 30 or 60 seconds. This second step of
authentication makes your account more secure, because even if someone
knows your login and password, they still need your physical mobile
device to see 2FA code sent to you. Such approach is highly used in
almost every single application, especially if this application has deal
with money, cryptocurrencies, banks, transactions etc.</p>
<p>So in this article, as you may noticed, we will talk about using
Google Authenticator app with your Java-based application. Let’s get
started!</p>
<h2 id="gmail-maven-project">Maven Project</h2>
<p>First of all, let’s create a maven project and add the following dependencies:</p>
<pre class="gmail-wp-block-preformatted"><dependency><br> <groupId>de.taimos</groupId><br> <artifactId>totp</artifactId><br> <version>1.0</version><br></dependency><br><br><dependency><br> <groupId>commons-codec</groupId><br> <artifactId>commons-codec</artifactId><br> <version>1.10</version><br></dependency><br><br><dependency><br> <groupId>com.google.zxing</groupId><br> <artifactId>javase</artifactId><br> <version>3.2.1</version><br></dependency></pre>
<p>Here is why we need those dependencies in our project:</p>
<ul><li><strong><em>totp</em></strong> – The Time-based One-Time Password
algorithm (TOTP) is an extension of the HMAC-based One-time Password
algorithm (HOTP) generating a one-time password by instead taking
uniqueness from the current time.</li><li><strong><em>commons-codec</em></strong>– for converting inputs to hex and base32.</li><li><strong><em>zxing</em></strong> – library for generating QR codes.</li></ul>
<p>Also you need to install Google Authenticator app to your smartphone.
It’s totally free and is available on App Store and Play Market. In
order to add new entry to Google Authenticator app you need to enter
manually a secret key or scan a QR code. I will show you how to use both
of them in this tutorial. Let’s start with manual one first.</p>
<p>Google Authenticator requires 20 bytes secret key encoded as base32
string. We need to generate this key using the following code:</p>
<pre class="gmail-wp-block-preformatted">public static String generateSecretKey() {<br> SecureRandom random = new SecureRandom();<br> byte[] bytes = new byte[20];<br> random.nextBytes(bytes);<br> Base32 base32 = new Base32();<br> return base32.encodeToString(bytes);<br>}</pre>
<p>After running this method you should see the generated string with 32
characters. Please write down this string somewhere since this is our
secret key and we will use it later.</p>
<pre class="gmail-wp-block-preformatted">QDWSM3OYBPGTEVSPB5FKVDM3CSNCWHVK</pre>
<p>Now open your Google Authenticator app. Press ‘<em>plus</em>’ button to add a new entry and select ‘<em>Manual entry’.</em> In the ‘<em>Account’ </em>field enter your email address or any name and in ‘<em>Key</em>’
field paste our secret key. Press save button. You should see your
entry in the list with 6-digits code that is changing every 30 seconds.</p>
<img class="gmail-alignnone gmail-wp-image-342" src="https://oril.co/wp-content/uploads/2021/08/1_xp0pyjkeygld7ktpajw89q-1024x461.png" alt="google aunteficator image" width="1024" height="461">
<p>Now let’s write a method that converts base32 encoded secret keys to
hex and uses the TOTP to turn them into 6-digits codes based on the
current time.</p>
<pre class="gmail-wp-block-preformatted">public static String getTOTPCode(String secretKey) {<br> Base32 base32 = new Base32();<br> byte[] bytes = base32.decode(secretKey);<br> String hexKey = Hex.<em>encodeHexString</em>(bytes);<br> return TOTP.<em>getOTP</em>(hexKey);<br>}</pre>
<p>Now let’s run the following code to generate time-based 6-digits code in sync with Google Authenticator.</p>
<pre class="gmail-wp-block-preformatted">String secretKey = "QDWSM3OYBPGTEVSPB5FKVDM3CSNCWHVK";<br>String lastCode = null;<br>while (true) {<br> String code = <em>getTOTPCode</em>(secretKey);<br> if (!code.equals(lastCode)) {<br> System.<em>out</em>.println(code);<br> }<br> lastCode = code;<br> try {<br> Thread.<em>sleep</em>(1000);<br> } catch (InterruptedException e) {};<br>}</pre>
<p>If you did everything correctly then you should see the 6-digits code
being displayed in console every 30 seconds and this code should be
synchronized with code displayed in Google Authenticator. If they are
not synchronized then make sure that time on your PC and mobile device
is in synch.</p>
<h2 id="gmail-qr-code">QR code</h2>
<p>We have finished with manual entry example, so let’s jump to QR code which is more user friendly and is used in most cases.</p>
<p>First of all we need to receive bar code data from google. It
requires some special format, so here is our method to generate this
data.</p>
<pre class="gmail-wp-block-preformatted">public static String getGoogleAuthenticatorBarCode(String secretKey, String account, String issuer) {<br> try {<br> return "otpauth://totp/"<br> + URLEncoder.<em>encode</em>(issuer + ":" + account, "UTF-8").replace("+", "%20")<br> + "?secret=" + URLEncoder.<em>encode</em>(secretKey, "UTF-8").replace("+", "%20")<br> + "&issuer=" + URLEncoder.<em>encode</em>(issuer, "UTF-8").replace("+", "%20");<br> } catch (UnsupportedEncodingException e) {<br> throw new IllegalStateException(e);<br> }<br>}</pre>
<p>Here is some notes about the generated string above:</p>
<ul><li>Account is the user id in system. Usually it’s user’s email or username. It’s used to label entries within Google Authenticator.</li><li>Issuer is a company or organization name and is also used for labelling purposes.</li><li>All dynamic values must be URL encoded.</li><li>Google Authenticator doesn’t seem to deal with spaces encoded as plus signs. Encoding spaces as %20 seems to work.</li></ul>
<p>Now run the above code with some test account name, issuer name and secret key generated previously:</p>
<pre class="gmail-wp-block-preformatted">String secretKey = "QDWSM3OYBPGTEVSPB5FKVDM3CSNCWHVK";<br>String email = "<a href="mailto:test@gmail.com">test@gmail.com</a>";<br>String companyName = "My Awesome Company";<br>String barCodeUrl = Utils.<em>getGoogleAuthenticatorBarCode</em>(secretKey, email, companyName);<br>System.<em>out</em>.println(barCodeUrl);</pre>
<p>You should receive a string in the following format:</p>
<pre class="gmail-wp-block-preformatted">otpauth://totp/Awesome%20Company%3Atest%<a href="http://40gmail.com?secret=7t4gabg72liipmq7n43lt3cw66fel4iz&issuer=Awesome%20Company">40gmail.com?secret=7t4gabg72liipmq7n43lt3cw66fel4iz&issuer=Awesome%20Company</a></pre>
<p>Now the last step is left – to generate a QR code. Let’s use ZXing library to do it.</p>
<pre class="gmail-wp-block-preformatted">public static void createQRCode(String barCodeData, String filePath, int height, int width)<br> throws WriterException, IOException {<br> BitMatrix matrix = new MultiFormatWriter().encode(barCodeData, BarcodeFormat.<em>QR_CODE</em>,<br> width, height);<br> try (FileOutputStream out = new FileOutputStream(filePath)) {<br> MatrixToImageWriter.<em>writeToStream</em>(matrix, "png", out);<br> }<br>}</pre>
<p>Calling this method with the string returned by the method in the
previous step as the 1st argument will write a PNG image to the
specified path with the specified height and width.</p>
<img class="gmail-alignnone gmail-wp-image-344" src="https://oril.co/wp-content/uploads/2021/08/1_pnerxyxcubs0violzevbmw-1024x476.png" alt="qr-code image" width="1024" height="476">
<p>Go ahead and try to use your generated image with the “Scan barcode”
option you saw previously in Google Authenticator. After scanning this
QR code you should see a new entry in Google Authenticator entry list.</p>
<p>We can simulate user’ login into the system. Let’s imagine that user
entered his credentials and now he need to enter 2FA code from Google
Authenticator. Here is the easiest code snippet:</p>
<pre class="gmail-wp-block-preformatted">Scanner scanner = new Scanner(System.<em>in</em>);<br>String code = scanner.nextLine();<br>if (code.equals(<em>getTOTPCode</em>(secretKey))) {<br> System.<em>out</em>.println("Logged in successfully");<br>} else {<br> System.<em>out</em>.println("Invalid 2FA Code");<br>}</pre>
<p>Of course this is just a pseudo code, but it simulates the real 2FA flow and shows you if you did everything correctly.</p>
<h1 id="gmail-b2c2">Conclusion</h1>
<p>Now you know the basics of two-factor authentication and you can try
to integrate it into your web-based application with a small efforts to
add more security to your application.</p>
<p>Hope you like this article. Do not forget to press ‘Clap’ button and
share this article with your friends. The full example can be found on
my <a href="https://github.com/IhorSokolyk/google-2fa" target="_blank" rel="noreferrer noopener">GitHub</a> account.</p>
<p>Have a great day! And don’t forget to enable 2FA in all your accounts:) </p></div></div></div></div></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg5484572631066607533"><div dir="ltr"><div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Det som er viktig er at nikita har en god implementasjon av tilgangskontroll slik at folk ikke kan hente ut dokumentasjon de ikke har tilgang til. Det er noe jeg synes er verdt en diskusjon. OAuth claims opp mot roller i et arkivsystem.</div>
</div></div></blockquote><div><br></div><div>Jeg tror at enten Microsoft Authenticator eller Google Authenticator er veien å gå til gradering.</div><div><br></div><div>Se eksempler på Authenticator i Java på <a href="https://oril.co/blog/two-factor-authentication-with-java-and-google-authenticator/">https://oril.co/blog/two-factor-authentication-with-java-and-google-authenticator/</a><br></div><div><br></div><div>Mvh,</div><div>Ole</div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg5484572631066607533"><div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
- Thomas</div>
<div id="m_5849148490772519022appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="m_5849148490772519022divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>Fra:</b> nikita-noark <<a href="mailto:nikita-noark-bounces@nuug.no" target="_blank">nikita-noark-bounces@nuug.no</a>> på vegne av Ole Aamot <<a href="mailto:ole@aamotsoftware.no" target="_blank">ole@aamotsoftware.no</a>><br>
<b>Sendt:</b> fredag 12. august 2022 15:39<br>
<b>Til:</b> <a href="mailto:nikita-noark@nuug.no" target="_blank">nikita-noark@nuug.no</a> <<a href="mailto:nikita-noark@nuug.no" target="_blank">nikita-noark@nuug.no</a>><br>
<b>Emne:</b> Klassifiserte dokumenter og sikkerhetsnivå i Nikita Noark5 Core</font>
<div> </div>
</div>
<div><font size="2"><span style="font-size:11pt">
<div>I hvilken grad kan USA og amerikanske myndigheter benytte Nikita Noark
<br>
Core til å lagre sensitive opplysninger som ikke skal være offentlig <br>
informasjon og ser Dere på USAs myndigheter som en konsument av <br>
arkivsoftware med kryptering utviklet i Norge?<br>
<br>
I USA er det nå en kamp med FBI om utlevering av klassifiserte <br>
dokumenter om atomvåpen,<br>
etter at Trump har tatt med seg klassifisert informasjon fra Det Hvite <br>
Hus til sin<br>
ranch i Florida, som ble ransaket onsdag 10. august 2022 etter subpoena <br>
fra FBI.<br>
<br>
<a href="https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.nytimes.com%2F2022%2F08%2F11%2Fus%2Fpolitics%2Ftrump-fbi-subpoena.html&data=05%7C01%7Ctsodring%40oslomet.no%7C7f2fbd4fa078401dfe3608da7c681100%7Cfec81f12628645508911f446fcdafa1f%7C0%7C0%7C637959083799121808%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=qI9l3jm0tIgcKh%2BF4CWjb4ZDnK8w9CurrvRAtPFqFiU%3D&reserved=0" target="_blank">https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.nytimes.com%2F2022%2F08%2F11%2Fus%2Fpolitics%2Ftrump-fbi-subpoena.html&data=05%7C01%7Ctsodring%40oslomet.no%7C7f2fbd4fa078401dfe3608da7c681100%7Cfec81f12628645508911f446fcdafa1f%7C0%7C0%7C637959083799121808%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=qI9l3jm0tIgcKh%2BF4CWjb4ZDnK8w9CurrvRAtPFqFiU%3D&reserved=0</a><br>
<br>
Regner med at informasjonen i Nikita er kryptert med en <br>
krypteringsalgoritme og<br>
seed ved hjelp av passord. Hvilken krypteringsmetode <br>
(RSA/DSA/ElGamal/Commfides)<br>
benytter Nikita til å kryptere informasjon eller er det ikke sikkerhet i <br>
systemet?<br>
<br>
Forventer egentlig ikke noe svar på dette, men regner med at Dere vet <br>
hva som kreves fra RSA Security LLC og Commfides for offentlige <br>
tjenester på høyeste sikkerhetsnivå (nivå 4).<br>
<br>
Mvh,<br>
Ole Aamot<br>
_______________________________________________<br>
nikita-noark mailing list<br>
<a href="mailto:nikita-noark@nuug.no" target="_blank">nikita-noark@nuug.no</a><br>
<a href="https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.nuug.no%2Fmailman%2Flistinfo%2Fnikita-noark&data=05%7C01%7Ctsodring%40oslomet.no%7C7f2fbd4fa078401dfe3608da7c681100%7Cfec81f12628645508911f446fcdafa1f%7C0%7C0%7C637959083799121808%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ajnyA2UWNBVOwxy4FTY2MTuEMpHiceQBAPZ5rilSFH0%3D&reserved=0" target="_blank">https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.nuug.no%2Fmailman%2Flistinfo%2Fnikita-noark&data=05%7C01%7Ctsodring%40oslomet.no%7C7f2fbd4fa078401dfe3608da7c681100%7Cfec81f12628645508911f446fcdafa1f%7C0%7C0%7C637959083799121808%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=ajnyA2UWNBVOwxy4FTY2MTuEMpHiceQBAPZ5rilSFH0%3D&reserved=0</a><br>
</div>
</span></font></div>
</div>
_______________________________________________<br>
nikita-noark mailing list<br>
<a href="mailto:nikita-noark@nuug.no" target="_blank">nikita-noark@nuug.no</a><br>
<a href="https://lists.nuug.no/mailman/listinfo/nikita-noark" rel="noreferrer" target="_blank">https://lists.nuug.no/mailman/listinfo/nikita-noark</a><br>
</div></blockquote></div></div>