Tagged Questions
2
votes
4answers
258 views
Why do APIs use API Keys instead of Usernames?
It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
1
vote
4answers
301 views
SSH: reusing public keys and known-man-in-the-middle
Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key):
Best Practice: “One per-user ssh key” or ...
1
vote
2answers
703 views
Creating user specific authentication methods in SSH
I have configured sshd on an Ubuntu server to use key authentication and it is working fine.
I had to disable password authentication for key authentication to work.
Server is always accessed via ...
5
votes
2answers
156 views
Authenticating client without hardcoding key?
A basic question, but I'm not a master and this is puzzling me-
How is it possible to authenticate a client from the server's perspective?
i.e. imagine you're the server, and you want to give the ...
1
vote
1answer
612 views
Google custom Search Engine api key: is it confidential?
Normally, I'd say yes, api keys should be kept secret, and Google's api console even says that. However, I'm just making an ajax get call and all the info is in the clear on my page in order to ...
1
vote
1answer
229 views
Hybrid key management doing it wrong?
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
0
votes
1answer
511 views
What are the potential vulnerabilities in a SAML-based SSO approach?
What level of access would an attacker need to obtain to compromise a SAML-based SSO system?
Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
6
votes
4answers
561 views
can ssh passwordless public key authentication be ok if combined with a VPN?
Having a debate with a coworker about the merits & faults of public key authentication with ssh.
I'm basically wondering what all the possible merits and faults are, especially in regards to ...
72
votes
3answers
44k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
23
votes
6answers
1k views
Is using a public-key for logging in to SSH any better than saving a password?
Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
4
votes
2answers
141 views
Question about the SessionLock paper
Some time ago there was a big fuzz over Firesheep: by listening to wifi traffic your login session can be stolen which is very bad because now somebody can e.g. send emails on your behalf. Some people ...
8
votes
3answers
1k views
What common products use Public-key cryptography?
I want know what common use products are there that use public key/private key cryptography?
