Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites? The pitch is that if such a HTTP request were to come in, then certain XSS ...
It's clear there there is no consistent set of features among any of the popular authentication providers. Below is an attempt to aggregate the similarities and differences I've noticed, but I ...
If one has logged into a "heartbleed-vulnerable" site using OpenID, for example, using Google to log into StackExchange, does that mean that the Google password is now at risk as well?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...
This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements). Currently, password requirements are: Must contain 3 of: lower case ...
Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...