Explicitly prevent network access?

[David Kassa]

I love this idea. The permissions and the fact that you're on my local machine with a fresh OTP makes me (obviously) nervous. Is there a way to explicitly prohibit an app from having network access? If so, can you include this in your instructions?

[Justin Mitchell]

If we completely prohibit network we couldn't do app updates. We were CONSIDERING having a server side "whitelist" of 2fa formats that the app can detect as well. It wouldn't actually present any security concern but it might make it look like one. Thoughts?

[David Kassa]

These are great considerations. And a tough beast to tame. Local system access (potentially to a password manager) and fresh OTP makes this a scary app. I'm not sure if there's a reasonable way around that - especially with server-side features. In theory, any local app can do the same thing so maybe it just comes down to a trust issue. Open Source helps with that along with your candor.

…

On Wed, Jun 23, 2021 at 9:08 AM Justin Mitchell ***@***.***> wrote: If we completely prohibit network we couldn't do app updates. We were CONSIDERING having a server side "whitelist" of 2fa formats that the app can detect as well. It wouldn't *actually* present any security concern but it might make it look like one. Thoughts? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGG6AO7L3Y33OK7UV6JOS3TUHTE7ANCNFSM47F4CTOQ> .

[Alec Armbruster]

@davidkassa Try downloading Little Snitch and observing/blocking Ohtipi's traffic as desired. You'll see that it only phones home to check for new releases (blocking this will prevent Ohtipi from autoupdating).