Tag Info

New answers tagged

0

...but I am looking for practical threats in such a scenario (C#) There are a huge number of ways that you could introduce a vulnerability by rolling your own login. A few that come to mind: User enumeration - I've seen people who give descriptive messages when a login fails ("user does not exist", "user exists, but password was incorrect", etc.) ...


0

I taught to never "roll your own" in situations where there is something already written to do something similar. If I were you I would try to find something thats proven to work and try to build around or on top of that.


4

The danger is expressed in Schneier's law: any person can invent a security system so clever that he or she can't imagine a way of breaking it. The only way anyone knows to test if any given system is secure is to have lots and lots of clever people try to break it over a long period of time. You won't have that with a system you rolled yourself.


1

In an Active Directory setup, the "certificate templates" are supposed to be used by the clients and by the CA itself ("AD Certificate Services"). For the CA, the templates describe how certificates shall be issued, including: The certificate contents, including all the extensions, validity period and so on. The issuing conditions, e.g. whether the ...


-1

This post might be downvote but I find your real question interesting. Which I consider to be: How to share password between user of your service on Internet? Let's start with some assumptions Architecture of your service Each user have an account protected by a master password known only by themselves Each user have a series of encrypted password ...


3

Don't invent your own cryptographic protocols. It's easy to come up with all kinds of ideas and combine all kinds of techniques, but doing this properly is exceptionally hard and requires a lot of experience and extensive peer reviews. This isn't something you can do on your own in a few minutes, especially if you don't happen to be a cryptographer. What ...



Top 50 recent answers are included