Ξ welcome to cryptostorm's member forums ~ you don't have to be a cryptostorm member to post here Ξ
∞ take a peek at our legendary cryptostorm_is twitter feed if you're into that kind of thing ∞
Ξ we're rolling out voodoo network security across cryptostorm - big things happening, indeed! Ξ
Ξ any OpenVPN configs found on the forum are likely outdated. For the latest, visit GitHub Ξ

Error: Authorization failed for that token

Looking for assistance with a cryptostorm connection issue? Post here & we'll help out. Also: if you're not sure where to post, do so here & we'll move things around as needed. Also: for quickest support, email our oddly calm & easygoing support reps at support@cryptostorm.is :)

Topic Author
nerdyrob
Posts: 2
Joined: Tue Feb 28, 2017 5:35 pm

Error: Authorization failed for that token

Postby nerdyrob » Tue Feb 28, 2017 5:43 pm

Been getting a weird error since my power browned out this afternoon and I had to restart some network equipment.
Been getting:
Error: Authorization failed for that token
Doesn't matter what node I try.
Tried to do some self help and also checked out:
https://www.cryptostorm.nu
I get the message of:
That token has reached the maximum number of sessions.
Thoughts/ideas? I waited a couple of hours to see if what ever ghost session timed out but no go.
Oh, and I'm using the latest widget.

User avatar

Fermi
ForumHelper
Posts: 208
Joined: Tue Jun 17, 2014 11:42 am

Re: Error: Authorization failed for that token

Postby Fermi » Tue Feb 28, 2017 5:48 pm

Only solution for that is sending token or hash to support@cryptostorm.is, so I can reset the sessions.

/fermi


Topic Author
nerdyrob
Posts: 2
Joined: Tue Feb 28, 2017 5:35 pm

Re: Error: Authorization failed for that token

Postby nerdyrob » Tue Feb 28, 2017 5:52 pm

Thanks for the quick response.
I've emailed away.


Like blackberries

Re: Error: Authorization failed for that token

Postby Like blackberries » Sun Mar 12, 2017 3:49 am

Fermi wrote:Only solution for that is sending token or hash to support@cryptostorm.is, so I can reset the sessions.

/fermi


Emailing tokens seems a bit risky as email addresses and user tokens might begin to correlate the more data is shared.

It'd be nice if there were a https 'return' system rather than sending stuff via unencrypted email, leaving ip trails and logs etc.

If people aren't smart enough to cryptofree in and use something like guerrillamail, they're exposing real up or email or both and their token or token hash!?

User avatar

parityboy
Site Admin
Posts: 1013
Joined: Wed Feb 05, 2014 3:47 am

Re: Error: Authorization failed for that token

Postby parityboy » Sun Mar 12, 2017 7:35 am

@Like blackberries

It's not ideal but there are options, however cumbersome they may be. Obviously this depends on how you paid for the token - if you used your real name and your own credit card then the risk only becomes apparent if you then send the same token to be reset while using a different email address; therein lies the opportunity for correlation.

CS do make an effort to not keep logs in order to avoid such correlation from happening. Having said that though, the person who purchases the token is not guaranteed to be the person who uses it. We as members can help this along by using a consistent channel of communication when dealing with token issues and keeping the emails as clean as possible - simply saying "Please reset this token" is more than enough; there's no need to refer to any thread on the forums, especially one you have started. :p

As for the mail, CS staff do use PGP so you can send them an encrypted mail from an burner address, just remember to include your public key with your email. :) You could also look at using Bitmessage over Tor as an option. :)


ywety

Re: Error: Authorization failed for that token

Postby ywety » Sun Mar 12, 2017 2:20 pm

token refresh via Threema running in anonymous mode .. perhaps ?


Captain Blackberry
Posts: 19
Joined: Thu Oct 15, 2015 2:11 pm

Re: Error: Authorization failed for that token

Postby Captain Blackberry » Mon Mar 13, 2017 11:24 pm

A better approach would be to have a website basically like the purchasing system.

Dump your token into it, provide an email address, and a new token the correct length is sent to you.

The old one is blocked.

You're essentially buying a new token with an old blocked one, but a record can be kept for tracking abuse of the system.


Emailing and admin time overhead seems wasteful?

Or is token over-use a big problem?


Captain Blackberry
Posts: 19
Joined: Thu Oct 15, 2015 2:11 pm

Re: Error: Authorization failed for that token

Postby Captain Blackberry » Mon Mar 13, 2017 11:27 pm

parityboy wrote:@Like blackberries

It's not ideal but there are options, however cumbersome they may be. Obviously this depends on how you paid for the token - if you used your real name and your own credit card then the risk only becomes apparent if you then send the same token to be reset while using a different email address; therein lies the opportunity for correlation.

CS do make an effort to not keep logs in order to avoid such correlation from happening. Having said that though, the person who purchases the token is not guaranteed to be the person who uses it. We as members can help this along by using a consistent channel of communication when dealing with token issues and keeping the emails as clean as possible - simply saying "Please reset this token" is more than enough; there's no need to refer to any thread on the forums, especially one you have started. :p

As for the mail, CS staff do use PGP so you can send them an encrypted mail from an burner address, just remember to include your public key with your email. :) You could also look at using Bitmessage over Tor as an option. :)


Ah PGP, I suppose I could use a tutanota or protonmail account with encryption too.


But purely from a consumer POV it's a pain in the bottom to have to jump through these hoops to get my token working when I've done nothing wrong.

This is where CS falls down for me. Being obfuscated offers great protection, but obfuscated support is a pita.

CS team should focus a bit of attention here so it's less painful for users to rectify CS's faults.
It's a lovely learning experience and opSec practice thinking things through all the time, but sometimes you're just tired of it all and just want it to work when you're on the mobile away from home!

User avatar

parityboy
Site Admin
Posts: 1013
Joined: Wed Feb 05, 2014 3:47 am

Re: Error: Authorization failed for that token

Postby parityboy » Thu Mar 16, 2017 4:39 am

Captain Blackberry wrote:A better approach would be to have a website basically like the purchasing system.

Dump your token into it, provide an email address, and a new token the correct length is sent to you.

The old one is blocked.

You're essentially buying a new token with an old blocked one, but a record can be kept for tracking abuse of the system.


This is actually a good idea...unfortunately, until CS actually fix the issue with session counting you'll be doing it all the time, so it would still be just as annoying, just less time consuming. :P


IPYfaf

Re: Error: Authorization failed for that token

Postby IPYfaf » Sun Mar 19, 2017 12:14 am

Protonmail has yet to respond to email complain for locked out account.

Back then all they needed to do was reset the mailbox password, and allow me to log in to initiate new mailbox creation. But no ; no help from their end.

It is hard to trust their implementation of PGP. Or their mailbox security for that matter.

And if you read their fine print they turn over encrypted mailboxes upon binding requests.
Yes, although they do not have knowledge of your passwords they are still legally bound to retain or hand over encrypted mailboxes if they cannot ignore the legal request.

So please stay away from Protonmail.


Captain Blackberry
Posts: 19
Joined: Thu Oct 15, 2015 2:11 pm

Re: Error: Authorization failed for that token

Postby Captain Blackberry » Mon Apr 17, 2017 8:06 pm

Thanks for the heads up on Protonmail.

It seems expensive for what they offer vs Tutanota.

But then Tutanota don't seem entirely 'safe' either.

On PGP, does anyone have a small 'app' that does PGP encryption? Ie, takes a string and encrypts/decrypts given certain keys?
Is there something that might sit inside Notepad++ for example?

I did try finding a PGP tool but they were huge 60meg+ packages. Surely that's a lot of bloatware?

I'd have thought PGP would be a 10kb app at the most, with file i/o for keys and a GUI for i/o of text/encrypted text?!


gnaTd

Re: Error: Authorization failed for that token

Postby gnaTd » Thu Apr 20, 2017 10:40 pm

In my case, been using GnuPG for desktops and OpenKeyChain (or APG) on Android.

have a look at minilock, Passlok Privacy also .. neat stuff


not to mention Oversec.io


Return to “member support & tech assistance”

Who is online

Users browsing this forum: No registered users and 10 guests

Login