Slashdot Mirror

← Back to Stories (view on slashdot.org)

TiVo Web Security and Two-Factor Authentication?

Posted by Cliff on from the hardening-your-PVR dept.

mr. mulder asks: "I just attached my TiVo to my home network, giving me the ability to change my recording settings from any browser on my internal network. I would like to take this a step further and enable TiVo config changes from work, but I'm worried about security. SSL would encrypt my traffic, but wouldn't prohibit access. Ideally, I would like an easy, client-less, two-factor authentication solution. Has anyone tried this? Moreover, are there any inexpensive, secure or two-factor authentication products to protect personal/home web URLs? I've considered publishing the page on the web without security, but that leaves me wide-open. I've also considered a VPN solution with my LinkSys Firewall/Router, but it involves a client installation. As an alternative, I've turned to two-factor authentication schemes, including products such as Rainbow's iKey, Authenex's A-Key and RSA's SecureID, but they are too expensive."

3 of 36 comments (clear)

  1. Use the recommened solution by TwoStep · · Score: 2, Informative

    Try using reverse proxying through apache. I am unsure where the docs were on how to set it up, but it was pretty easy.

    Twostep

    --
    There are 10 different types of people in this world... those who understand binary, and those who don't.
  2. Reverse Proxy by Samus · · Score: 4, Informative

    I may be wrong on this but couldn't you place Apache in front of the tivo with a proxy pass directive. I would think that you could even have it do basic authentication on that directory. Couple that with ssl and you should have a pretty decent secure system. The only problem that you might run into is if the Tivo pages generate absolute URLs with the server name in them. Worse case scenario is you write a php, perl or jsp front end that makes calls back to the Tivo web server.

    --
    In Republican America phones tap you.
  3. Re:This seems like something for PAM by TomsFingerKeys · · Score: 3, Informative
    (Reposted to fix formatting)

    This is the kind of thing the PAM (Pluggable Authentication Modules) is meant to solve. I'm not sure how you would tie it in to your system yet, but some of these Java-centric links might help:

    http://java.sun.com/products/jaas/
    http://java.sun.com/j2se/1.4.1/docs/guide/security /jgss/tutorials/
    http://java.sun.com/j2se/1.4.1/docs/guide/security /jaas/tutorials/
    http://www.pramati.com/docstore/1270002/index.htm
    http://www.oreillynet.com/pub/d/861