Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Authorization is a key theme in computer security practices.

learn more… | top users | synonyms

1
vote
1answer
62 views

Authorization before Authentication?

From a conceptual point of view, can authorization occurs without authentication taking place first? I'm thinking about few cases where authorization seems to occur without authentication taking place ...
0
votes
1answer
75 views

Active directory authentication and authorization for an application

Currently all our applications are web based and our authentication and authorization mechanism is always through the database. eg database logins and access controls defined at database. However now ...
4
votes
2answers
53 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
5
votes
1answer
50 views

How to secure a local socket?

I have made a service written in c that runs on the Android operating system as a core service. I have a few Android apps which communicate with this service via a socket connection (Java -> C). My ...
0
votes
0answers
86 views

Multiple user type management - token based authentication

I am currently working on an e-commerce application. The application has different users: Customers Merchants Logistics Admin The current db structure has a different table for each of these user ...
7
votes
1answer
383 views

How to protect a Wifi network from Microsoft WiFi Sense

Microsoft is deploying a new feature, WiFi Sense, which provides users a way to easily share passwords to wireless networks with all of their contacts. This introduces a new security failure mode: a ...
3
votes
2answers
80 views

Does enabling EnableLinkedConnections pose a security risk?

As shown Microsoft's TechNet, network shares that are mapped by logon scripts are shared with the standard user access token instead of with the full administrator access token. Here's the gist of it: ...
1
vote
1answer
45 views

Are there any simpler ABAC implementations available for big data systems? [closed]

Can any one suggest simpler Attribute Based Access Control implementations available for big data systems like Hadoop, Hive etc? I have checked Apache ranger they dont have any support for ABAC yet ...
1
vote
1answer
72 views

Create Public Key using OpenSSL instead of PuTTYgen for PKCS#8

I'm trying to create a public key pair for ssh-rsa authentication. If I'm using puttygen.exe, the "OpenSSH authorized_keys file" string looks like this: "ssh-rsa AAAAB3 ... 6yIK9Nbw== ...
5
votes
1answer
123 views

Security protocol for NFC stickers/cards

Lets say I'm using NFC cards for access control. NFC cards/stickers are easily readable and writable, so my worry is that the data on them could easily be cloned onto another card/sticker and bypass ...
1
vote
0answers
74 views

JWT for User Authentication + Client App Authentication + User Claims Holder?

I would like to switch the security layer of my API from Basic Auth over HTTPS + claims-based infrastructure (w/ claims populated in a delegatinghandler) to a more robust mechanism and support client ...
0
votes
2answers
289 views

Table or row level security in ASP.NET MVC 5 and Entity Framework 6

I've already asked this question on Stack Overflow, but no one answered, so maybe it's a more appropriate place to discuss it. Please let me know if I'm wrong and having duplicated question on ...
1
vote
1answer
53 views

Centralized authorization with distributed service providers

I'm thinking about implementing a single sign on service with a centralized permissions management for a distributed network of service providers (so authentication as well as authorization). The ...
0
votes
1answer
48 views

How to manage a custom session in a webapp?

I was reading through the OWASP Cheat Sheet and something mentioned in the "Weak Authentication and Session Management" row did not make sense to me. It is recommended in the Design Column, that ...
3
votes
3answers
122 views

encryption vs access control comparison

I have a very basic and simple question about two security concepts. Both encryption and access control are used for privacy and to prevent unauthorized users from accessing some object (eg. files, ...
4
votes
1answer
75 views

Purpose for “One Time Use Token”

I'm connecting a Salesforce ORG with a third party vender through a custom API (they basically wrote it just for us). The API requires you to retrieve a "token" that you pass into other calls through ...
1
vote
2answers
104 views

Encrypting user credentials using AES: how to hide the key

One of my software (an R package) has to save on disk users sensitive information. I encrypt such information using AES encryption using a random key that is generated at the moment of installation ...
0
votes
1answer
91 views

How prevent online payment fraud? [closed]

What is the solution of independent payment authorization from hackers between bank and merchant? Some banks used SOAP protocol. I need another solution.
4
votes
2answers
286 views

Decide to REST API Security

I've developed an API. I got confused and I've been reading articles for days. Actually my question is close to these but not exact (maybe a combination of them); Securing REST API that will ...
2
votes
0answers
99 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
0
votes
2answers
111 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
1
vote
1answer
82 views

Why should we focus on protecting root access on a home computer?

I understand why root access should be protected in general, especially in the context of a server environment. An unknown party can essentially control everything you do on a computer remotely ...
2
votes
3answers
153 views

Is it okay to only use username/password to secure an admin page for moderating a website?

Is there a standard practice to securing an admin page for an application written in angular and nodejs or just in general? The admin page would approve/ban users and moderate comments. Should it be ...
1
vote
1answer
66 views

Retrieve anonymous credentials

Background A registration process to acquire an anonymous, verified account goes like this: Registrant provides proof of individuality to a Registrar. Registrar verifies proof, ensures no prior ...
0
votes
0answers
110 views

How to associate an oAuth token with a particular user. Is this possible?

We have HTTP Rest services and SignalR (aka Web sockets, server send events, etc) for cases in which we need to push data from the server to the Web UI . We are currently using the built in tools that ...
3
votes
1answer
85 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
0
votes
1answer
157 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to ...
3
votes
4answers
173 views

How webmail's authorisation should work?

I'm building a webmail client (like gmail). It allows the user to browse emails and send them. Under the hood, php uses IMAP and SMTP to talk with email server. user->webserver->mailserver When user ...
0
votes
0answers
81 views

What to use to encode JSON Web Token?

I'm using JWT to create access tokens for a Sinatra API. My question is, what should I use to sign the token? Right now I'm trying to use the user's password hash, but bcrypt-ruby changes the ...
1
vote
1answer
419 views

Risk of keeping OAuth2 client_secret in application

As an exercise, I'm developing a desktop application with which users need to log in to a web service. A logical use-case for OAuth2 one would say, but I'm beginning to doubt its usefulness. I am ...
0
votes
3answers
138 views

How to integrate AAA and otp

We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
0
votes
1answer
113 views

using temporary tokens for secure communication with IFRAME

I have questions about our application's security architecture: A critical piece that cannot save state but collects and displays sensitive information is served up in an IFRAME inside a more modern ...
2
votes
1answer
446 views

Arduino to Android secure bluetooth connection

I'm using an Arduino Uno and a nRF8001 board from Adafruit to connect to an Android phone over bluetooth. I will be using it to lock and unlock a lock and I need to make sure only verified devices are ...
1
vote
2answers
65 views

Is it normal if user gets logged in Facebook or Twitter after they use Like or Tweet button? [closed]

Personally I don't use social networks, so I'm not sure about their behaviour. Currently I must code website which heavily depends on "Likes" and "Tweets" about articles. Each article has Like and ...
2
votes
2answers
73 views

What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?

It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
2
votes
1answer
67 views

Kerberos Authorization host/service by host/service basis

I understand that Kerberos is for Authentication not Authorization, but Is it possible to get Kerberos to refuse to Authenticate certain users on specific hosts? I am currently using LDAP for ...
0
votes
1answer
36 views

Partial Man on the End Security

The Situation: I'm developing a script that runs in a popular sandbox game as a paid service for other developers. The problem is that the game does not implement a way to do so. The language is Lua ...
0
votes
0answers
87 views

Authorization using shibboleth sso

We have integrated shibboleth web sso into our application to authenticate the user, Now we want to do authorization for our application. The below is the process which is i am thinking for authz. ...
21
votes
3answers
7k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
1
vote
5answers
141 views

Is there a term for Authorizing before Authenticating? Is it even common?

In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform ...
1
vote
0answers
112 views

Using email to authorize access to a user's account

would greatly appreciate some advice from the experts here on this stackexchange. I'm building an application that requires access to a user's resources from a 3rd party application. This 3rd party ...
2
votes
0answers
215 views

NFS IP spoofing

I am using VirtualBox: where the guest is an Arch ISO and the host Windows/Cygwin or a generic Linux. For sharing host folders, VB native shared folders is not an option (since the setup requires ...
1
vote
0answers
82 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
54
votes
10answers
18k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
0
votes
1answer
133 views

Limiting account access based upon NIC used to connect on Linux

I have a server which has multiple NICs (ignoring redundant pairs): 'inward' facing production (connects to other servers); 'outward' external facing production (connects out to the internet via a ...
2
votes
1answer
69 views

API request modification

I am building an API that returns data about companies Multiple applications will access the API, some of these applications will have access to one company, some to multiple companies. When a request ...
4
votes
2answers
1k views

Claims based vs Permission based authorization

So I understand roles vs permissions. I also understand roles vs claims. In both cases claims and permissions are granular, usually per feature or business operation such as AddPerson permission. ...
1
vote
0answers
24 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
1
vote
0answers
156 views

Is there a way to restrict hls key file served by cloudfront (over https) to only authorized users

I have a video file which is distributed after hls packaging and encrypted using aes 128. Since HLS key url is part of the m3u8 file I have to restrict the delivery of key file only to authorized ...
0
votes
1answer
229 views

Is my understanding about how SSL works correct?

I've been reading about 2-way SSL or mutual auth recently, and here's what I've figured so far: Mutual auth is a way for the client to authenticate itself to the server, just like the server does to ...