Authorization is the process of determining whether a user, program or device is allowed to access a protected resource in a particular way. Authorization is a key theme in computer security practices.

learn more… | top users | synonyms

-2
votes
2answers
71 views

How do I know whether a server is running MySQL?

For example: http://somewebsite.com/auth?id=0123456 So the server wants to authorize me by checking if it can find my ID. I would like to know, where is it looking for it? In a database, or just a ...
2
votes
1answer
303 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
0
votes
1answer
27 views

Partial Man on the End Security

The Situation: I'm developing a script that runs in a popular sandbox game as a paid service for other developers. The problem is that the game does not implement a way to do so. The language is Lua ...
0
votes
1answer
43 views

ACL managed with roles

I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it. I also have defined a Table holding all uses that are ...
2
votes
0answers
15 views

What are proper security precautions when enabling multiple connected social accounts or login/authorization methods?

It is popular today for frameworks and social sites to enable multiple authorization options when creating websites. For example, allowing a user to login with GitHub, Twitter, Facebook, etc. In ...
2
votes
0answers
62 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
2
votes
0answers
88 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
1
vote
0answers
40 views

Using email to authorize access to a user's account

would greatly appreciate some advice from the experts here on this stackexchange. I'm building an application that requires access to a user's resources from a 3rd party application. This 3rd party ...
1
vote
0answers
87 views

NFS IP spoofing

I am using VirtualBox: where the guest is an Arch ISO and the host Windows/Cygwin or a generic Linux. For sharing host folders, VB native shared folders is not an option (since the setup requires ...
1
vote
0answers
47 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
1
vote
0answers
21 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
1
vote
0answers
63 views

Is there a way to restrict hls key file served by cloudfront (over https) to only authorized users

I have a video file which is distributed after hls packaging and encrypted using aes 128. Since HLS key url is part of the m3u8 file I have to restrict the delivery of key file only to authorized ...
1
vote
0answers
31 views

Tacacs won't match cmd rules included in both user and group area at the same time

I'm struggling to set up TACACS+ commands authorization. I have users defined in tacs_plus.conf. All of the users are members of group ADMIN. Group ADMIN has command authorization definitions. Now ...
1
vote
0answers
152 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
325 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
214 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
1
vote
0answers
549 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
0
votes
0answers
17 views

Authorization using shibboleth sso

We have integrated shibboleth web sso into our application to authenticate the user, Now we want to do authorization for our application. The below is the process which is i am thinking for authz. ...