Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Authorization is a key theme in computer security practices.

learn more… | top users | synonyms

11
votes
2answers
4k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
3
votes
2answers
2k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
2
votes
1answer
121 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
12
votes
2answers
7k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
3
votes
1answer
1k views

What are the risks posed by “pass-through authentication” and how are they mitigated?

Related: Local Admin has Domain Admin rights "Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one ...
0
votes
1answer
107 views

Where to perform authorisation in a web app?

Most web apps perform authorisation checks at the controller layer. This is basically ok, but complex apps tend to have repetitive checks. For example, there might be ten or so controller actions that ...
1
vote
1answer
258 views

How to write an authentication module for my website?

This will sound naive for sure, and it is. Being a recent college graduate, I have been wondering on how do average websites implement their authentication modules. I have been using a table storing ...
1
vote
2answers
248 views

Authorization in offline application

I'm working on a machine which needs to store usernames and passwords for the various operators, technicians, and engineers that may be using and configuring it. It is important that some functions be ...
6
votes
2answers
3k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
-1
votes
1answer
101 views

Is my invitation based file access authorization scheme worthwhile?

I need to allow users to upload files with sensitive data to a server, then invite other authenticated users to access specific files. This is my proposed solution: Each user will have his own ...
4
votes
1answer
1k views

Hotspot with same SSID, how does authorization work?

My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network. If someone sets up ...
1
vote
2answers
205 views

How many bytes should an authorization token have? [duplicate]

Assuming I generate random bytes with a secure PRNG, how many bytes do I need to make authorization tokens secure? Specifically, when users log in to a website, a token will be generated and stored ...
5
votes
1answer
2k views

WCF - Is this a good security Architecture?

I am building an information recording system (WCF based) for a business that is accessible by staff over the internet. This software will not be distributed and there will only be a handful of users ...
2
votes
1answer
206 views

Should the email address in the SOA be used to validate domain control?

I'd like to validate the ability to own a DNS domain and am already considering validation that is currently in use by others such as Email validation of Whois contacts Access to the ...
2
votes
0answers
88 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
2
votes
1answer
401 views

WSS (WSS4J): cleartext password in UsernameToken vs salted password hash in database

I'm currently struggling a little with the security layer of a web service I'm writing using WSS4J and CXF. We obviously do not wish to store plaintext passwords in our backend, but would prefer to ...
16
votes
4answers
6k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
4
votes
2answers
140 views

using two passwords for normal and security critical functions

a user (can be admin) for example in a website has: a password that is used for normal and everyday access (not security critical actions). another password that is used for performing security ...
-4
votes
1answer
496 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
0
votes
3answers
802 views

Connect to Mysql database from remote host without remote access [closed]

I have a website which is managed through CPanel. I know that remote database connections are disabled by default and I have tested that it is indeed disabled. I know that many people have some of my ...
5
votes
2answers
104 views

Preventing fraudulent access to restriced resource on the web?

I'm working on a web application along with a web API and I've been warned against what seems to be a basic vulnerability: not checking that the user making an action has sufficient privileges on the ...
3
votes
2answers
230 views

Does providing OAuth for mobile apps pose a security threat?

Let's take a look at the basic OAuth workflow: The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
2
votes
1answer
969 views

SSH says Authentication tried for XX with correct key but not from a permitted host

I am using and authorized_hosts file to authorise certain keys. One of those is restricted with the prefix from="1.2.3.4", the others are valid from anywhere. When accessing from a machine that has ...
1
vote
1answer
1k views

How WEP/WPA authentication works in a WiFi environment?

I'm looking on a clear schema that would explain how a computer connect to an WiFi access point (WEP or WPA in any version (1,2)). The basic schema would be : Computer looks which AP are available ...
6
votes
3answers
3k views

SAML2 vs. OAuth - What are some reasonable relationships?

I have a service that allows SSO via SAML2. When SAML2 is used, we delegate the entire authentication process to the Identity Provider. We are considering adding OAuth in order to support some ...
3
votes
1answer
435 views

user/pass auth vs hmac signed for REST API

I know they both prevent the RESTful APIs from abuse. Hmac signed api is commonly used than the other. But I think using user/pass pair for authorization is more security, here's the reason: To sign ...
2
votes
1answer
103 views

Best practices for setting up client connections to a server with app credentials

The question title is... ugly to say the least. Here's an overview of what I've got: I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back. ...
-1
votes
1answer
851 views

Can File Sharing being Controlled by Mac Address? [closed]

I am currently setting up secure environment between 2 pc in isolated network. Just wondering can we do file sharing based on that pc mac address instead of username? The environment is OEM Windows ...
0
votes
1answer
118 views

Implementing secure login for an API

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
1
vote
1answer
957 views

CSRF with OAuth or Bearer Authorization headers

I am designing a RESTful API which is to be accessible from a web browser. The API is protected by Basic authentication. I understand the concept of CSRF, and the mitigations proposed (I found both ...
1
vote
1answer
846 views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
0
votes
1answer
121 views

What are the dangers of client side authorization? [duplicate]

What are the dangers of client side authorization? Where client side authorization should and should not be used?
4
votes
4answers
169 views

How can an Subject only read and write to its owned objects?

It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our ...
2
votes
3answers
591 views

Using RADIUS for host authentication

Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a ...
1
vote
1answer
188 views

Are there any solutions available which conform to AAA protocol?

According to Wikipedia (http://en.wikipedia.org/wiki/AAA_protocol) In computer security, AAA commonly stands for authentication, authorization and accounting. It refers to a security architecture ...
20
votes
4answers
2k views

ZX Spectrum tape loader: how was copy prevention implemented?

I am curious how copy prevention was implemented for games or other programs loaded from cassette on the micro computers of the early 1980s, such as the ZX Spectrum 48k. If I recall correctly, some ...
3
votes
1answer
3k views

what is the role of RADiUS server and Active Directory to increase the security in wireless networks?

In the CBT Nuggets Video Training, one slide about Wireless networks : i want to know about the role of Radius to increase the security and how? in this project: Deploy Active Directory and ...
6
votes
1answer
739 views

Do I need to keep the NTLM token in the HTTP Authorization header a secret?

I'm troubleshooting a problem with one of our vendors and plan to send them a Fiddler trace of the http traffic between the client and our servers while replicating the issue. Our servers use NTLM ...
-2
votes
1answer
1k views

Credit Card Error. What doe “Bad Track 2” mean? [closed]

I am receiving this error when a customer is trying a transaction. What causes it?
1
vote
3answers
710 views

Validate hmac with hashed stored key

What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and ...
1
vote
2answers
522 views

Is dual control password is a feasible way to secure against unauthorized login?

I see that some organizations practice dual control password especially when it comes to critical system logins, etc. Is it feasible to implement such policy considering certain trade off such as ...
1
vote
2answers
800 views

authorization vs federation vs entitlement

I am vague among the three following terms: authorization, federation, entitlement (as stated by the OpenAM product: OpenAM provides open source Authentication, Authorization, Entitlement and ...
3
votes
2answers
232 views

Secure Spring FrameworkUser Management

I got asked this question: "Any decent reusable / plug-able Spring user management systems (registration, change pwd, reset etc)? How do you guys do authz in Spring, including managing those roles ...
9
votes
2answers
4k views

OAuth2 Cross Site Request Forgery, and state parameter

http://tools.ietf.org/html/draft-ietf-oauth-v2-30#section-10.12 says: The client MUST implement CSRF protection [...] typically accomplished by requiring any request sent to the redirection URI ...
7
votes
3answers
4k views

How to manage admin rights for helpdesk staff?

My question is about issuing administrative rights to helpdesk staff in a large Active Directory setting. Helpdesk staff commonly require administrative rights to provide support for end users. I ...
8
votes
4answers
576 views

Does UNIX have a dual approval mechanism?

Sudo and logging is used to keep administrators accountable. But is there a command/configuration that lets you enforce a dual approval type control such as the the "Two Person Concept"? (eg. Two ...
9
votes
4answers
443 views

How should I tell an organisation that they are vulnerable when I wasn't given permission to check?

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
3
votes
2answers
208 views

What value security wise, if any, does a digital handwritten signature have?

Here's an example of what I mean: (It's basically the same thing as a traditional signature.) Given I've never seen someone fail this control, it's unclear to me what real security such a system ...
1
vote
1answer
335 views

JS frontend for RESTful backend vs authorization

I'm building web-app. And i have concern about security issues. In world a lot of similar questions, but many of them does not have really clear answer(advise,suggestion). This is the reason why i ...
1
vote
2answers
945 views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...