Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Authorization is a key theme in computer security practices.

learn more… | top users | synonyms

0
votes
2answers
143 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
-1
votes
2answers
672 views

Is there a difference between Broken Access Control and Insecure Direct Object reference? [closed]

According to me,if this difference is correct,it is that for exploiting a broken access control you don't necessarily need to be logged into the application,but for exploiting insecure direct object ...
6
votes
2answers
2k views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
2
votes
2answers
163 views

How to build a secure affiliate network

I'm going to build a demo affiliate network, which needs to be secured. Let say I have a web application called Affiliate Network Manager that manages all affiliates associated with my online book ...
1
vote
1answer
67 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
0
votes
1answer
186 views

HTTP Status Codes - security considerations [duplicate]

I am designing an authorization framework and now I am thinking about the error codes which I should return when someone is trying to access a resource and he doesn't have the required permissions. ...
1
vote
0answers
223 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
3
votes
1answer
252 views

SAML for transporting authorization information

I'm thinking of using SAML for sending authentication and authorization information to system. I plan to send roles and other information as authentication attributes in the assertion. Does this ...
1
vote
0answers
464 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
283 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
3
votes
1answer
2k views

Looking for approach to implement attribute based access control (ABAC)

We are looking to implement Attribute-Based Access Control. While we are sold on the philosophy, there are two topics that seem to crop up: Will it lead to significant performance issues? Especially ...
3
votes
1answer
622 views

Securing mobile app rest requests

I am using Facebook login in a mobile native app, and I'm trying to figure out if my approach is secure enough. This is the flow (all communication is made over SSL): User logins to Facebook ...
5
votes
1answer
205 views

Cascaded Sudo for privilege elevation

I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
2
votes
1answer
98 views

What is the purpose of derivation of encryption and authorization keys from master key?

We're using AES-CBC and HMAC to encrypt and authenticate our messages (using encrypt-then-authenticate method). Sometimes I see solutions (like this one) which are deriving encryption and ...
1
vote
3answers
170 views

Authorization with MD5 imlemented in Javascript

I want to use MD5 function (JavaScript library) to hash password before send it to server during logging in to website and during registration proces. I want to ask is it a secure method? I can't ...
2
votes
1answer
3k views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
1
vote
1answer
102 views

What makes it difficult for Facebook to implement restriction/ACL for accessing uploaded photo? [closed]

Facebook claims to allow restrict sharing to friends, certain network, or even custom when I upload photos. But it appears that this security is only in effect for the page where the photo is ...
0
votes
2answers
143 views

Is sending authorizing links through e-mail a vulnerability?

I am not sure if my wording is right, but if I attach a unique token inside email links which will authorize the user if clicked, would you consider this a vulnerability? Password-reset partly ...
2
votes
2answers
136 views

RBAC and assertions, which authorization flow is better?

I'd like to ask which authorization flow is considered better or standard. First approach (has role AND assertion is valid): if (!isGranted(roles, permission) { return false; } if ...
0
votes
2answers
56 views

Should a user be able to change another user's role to match their own?

Lets say a web application has four user roles. Standard, Supervisor, Manager and Administrator. Should a manager be able to promote someone else to a Manager, or only to a supervisor? I realize in ...
1
vote
0answers
772 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
2
votes
1answer
483 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
1
vote
1answer
120 views

Protecting data on an embedded device

I am to release a system-on-chip device that, during its lifetime, will come to store sensitive data. I want to make that data hard to extract or duplicate. Encrypting is good for dealing with MiTM, ...
9
votes
1answer
577 views

What datastructure would/have you used to store ACLs within a hybrid ACL/RBAC system?

In our system, every resource has an access control list (ACLs), which list entries (ACEs) that have a specific kind of access to that resource. The ACE can be for end-entities (eg: users like "Mr Q") ...
0
votes
2answers
2k views

Look over my Web API Authentication Scheme

I want some advice on my Authorization/Authentication scheme that I will be using for my Web API that I am writing. Firstly the Authentication : 1) When a user first logs in and they are authorized, ...
0
votes
1answer
153 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
18
votes
4answers
5k views

How secure is NOPASSWD in passwordless sudo mode?

On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
2
votes
0answers
66 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
15
votes
2answers
6k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
6
votes
2answers
4k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
2
votes
1answer
124 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
20
votes
2answers
13k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
3
votes
1answer
2k views

What are the risks posed by “pass-through authentication” and how are they mitigated?

Related: Local Admin has Domain Admin rights "Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one ...
0
votes
1answer
113 views

Where to perform authorisation in a web app?

Most web apps perform authorisation checks at the controller layer. This is basically ok, but complex apps tend to have repetitive checks. For example, there might be ten or so controller actions that ...
1
vote
1answer
390 views

How to write an authentication module for my website?

This will sound naive for sure, and it is. Being a recent college graduate, I have been wondering on how do average websites implement their authentication modules. I have been using a table storing ...
1
vote
2answers
273 views

Authorization in offline application

I'm working on a machine which needs to store usernames and passwords for the various operators, technicians, and engineers that may be using and configuring it. It is important that some functions be ...
6
votes
2answers
5k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
-1
votes
1answer
101 views

Is my invitation based file access authorization scheme worthwhile?

I need to allow users to upload files with sensitive data to a server, then invite other authenticated users to access specific files. This is my proposed solution: Each user will have his own ...
5
votes
1answer
2k views

Hotspot with same SSID, how does authorization work?

My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network. If someone sets up ...
2
votes
2answers
383 views

How many bytes should an authorization token have? [duplicate]

Assuming I generate random bytes with a secure PRNG, how many bytes do I need to make authorization tokens secure? Specifically, when users log in to a website, a token will be generated and stored ...
5
votes
1answer
3k views

WCF - Is this a good security Architecture?

I am building an information recording system (WCF based) for a business that is accessible by staff over the internet. This software will not be distributed and there will only be a handful of users ...
2
votes
1answer
303 views

Should the email address in the SOA be used to validate domain control?

I'd like to validate the ability to own a DNS domain and am already considering validation that is currently in use by others such as Email validation of Whois contacts Access to the ...
2
votes
0answers
102 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
3
votes
1answer
571 views

WSS (WSS4J): cleartext password in UsernameToken vs salted password hash in database

I'm currently struggling a little with the security layer of a web service I'm writing using WSS4J and CXF. We obviously do not wish to store plaintext passwords in our backend, but would prefer to ...
26
votes
5answers
11k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
4
votes
2answers
143 views

using two passwords for normal and security critical functions

a user (can be admin) for example in a website has: a password that is used for normal and everyday access (not security critical actions). another password that is used for performing security ...
-4
votes
1answer
567 views

Feasibility of brute-force on online password [closed]

I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
0
votes
3answers
898 views

Connect to Mysql database from remote host without remote access [closed]

I have a website which is managed through CPanel. I know that remote database connections are disabled by default and I have tested that it is indeed disabled. I know that many people have some of my ...
5
votes
2answers
113 views

Preventing fraudulent access to restriced resource on the web?

I'm working on a web application along with a web API and I've been warned against what seems to be a basic vulnerability: not checking that the user making an action has sufficient privileges on the ...
3
votes
2answers
296 views

Does providing OAuth for mobile apps pose a security threat?

Let's take a look at the basic OAuth workflow: The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...