Suriya Subramanian suriya

Hello

Security issues with GST Network's Authentication API

One line summary. GSTN's use of OTP for authentication is not very secure. GSTN should use a standard like OAuth

The GST Network's (GSTN) version 0.2 draft API propose using a One-Time Password (OTP) for a Software to authenticate on behalf of a Tax Payer (user). The design of the Authentication API is documented here. The Authentication API is well designed to ensure that data communicated between any software and GSTN in secure.

However, the API uses an OTP to authenticate software on behalf of a user. Here is a relevant quote from the API document.

	The script run-and-stop-gunicorn.sh takes 1 second on both Python 2.7 and 3.4.

	$ cat /etc/lsb-release
	DISTRIB_ID=Ubuntu
	DISTRIB_RELEASE=14.04
	DISTRIB_CODENAME=trusty
	DISTRIB_DESCRIPTION="Ubuntu 14.04.2 LTS"
	$
	$
	$ source 27-env/bin/activate

	Distance (Score) 0.0
	Link Content Length 33
	Link Content Word Count 6
	Link Content 'Sushil Kumar v. Rakesh Kumar[6]'
	Link Target 23285 Sushil Kumar Vs. Rakesh Kumar
	================================================================================
	Distance (Score) 0.0001433401630492881
	Link Content Length 38
	Link Content Word Count 6
	Link Content 'Anil\n Rishi v. Gurbaksh Singh[1],'

	\section{\mysidestyle Education}
	{\bf PhD in Computer Sciences \hfill August '03 - May '10} \\
	Thesis: Dynamic Software Updates: A VM-Centric Approach \\
	Advisor: Prof. Kathryn S. McKinley \\
	Department of Computer Science \\
	The University of Texas at Austin

	{\bf Master of Science in Computer Sciences \hfill August '03 - May '06} \\
	Department of Computer Science \\
	The University of Texas at Austin


	from django.conf import settings

	settings.configure(
	DEBUG=True,
	SECRET_KEY='A-random-secret-key!',
	EMAIL_BACKEND = 'postmarker.django.EmailBackend',
	POSTMARK = {
	'TOKEN': 'POSTMARK_API_TEST',
	'TEST_MODE': True,

	import os
	import io
	import tempfile
	import subprocess
	import logging
	import zipfile
	from contextlib import contextmanager

	logger = logging.getLogger(__name__)