Hot answers tagged authorization
17
RBAC (Role based access control) is based on defining a list of business roles, and adding each user in the system to one or more roles. Permissions and privileges are then granted to each role, and users receive them via their membership in the role (pretty much equivalent to a group). Applications will typically test the user for membership in a specific ...
16
Back then, tapes were just binary data on a magnetic film, with no "hidden" channels or out-of-band capabilities. Manufacturers that claimed to make tape-to-tape recording impossible often just made the tape look different, to deter would-be pirates. A regular tape recorder module was usually used to read them, so making "special" tapes couldn't really work.
...
10
If I recall correctly, some games even managed to defeat direct tape-to-tape copying.
In principle, this couldn't be possible, as the audio track on the tape contained all the information required. In practice, by using a custom loader which operated on data files encoded at a higher frequency than the standard Spectrum data files, low-quality ...
8
One method which I have seen used: split the password. This was for SSH access to a sensitive server: a number of SSH keys were created, and marked as "authorized" on the server. Each private key was protected with a long passphrase, and every user knew only one half of the passphrase.
That's crude but effective as long as there are not too many ...
8
The April 2009 "session fixation attack" is described here: http://oauth.net/advisories/2009-1/ and in more detail here: http://hueniverse.com/2009/04/explaining-the-oauth-session-fixation-attack/
Security means different things from different perspectives. As I keep repeating on this site, it all depends on your threat model. Application providers have a ...
7
Well the first consideration is that SSL/TLS is absolutely necessary to implement correctly.
One must also consider 2-legged or 3-legged authn mechanisms. While most are going to recommend the more complex (and safe) 3-legged approach, it is possible that 2-legged would have advantages when done right for certain apps.
There have been some timing attack ...
6
Not really, if you want to implement a function where the administrative functions require stronger authentication you should opt for two factor authentication rather than two passwords. The reason for this is that if an attacker can get your password somehow, chances are they can also retrieve the second one.
5
Well, by definition if some organisations are doing it, it must be feasible!
More generally, all security controls have a cost and when you select a control the cost must be taken into account. Is it worth it? If so, implement it. If not, don't.
Dual password control is a very powerful and effective control against loss of integrity; but as you point out ...
4
It seems that you are conflating between RBAC and DAC (Discretionary Access Control): Deny Access is not typically employed in RBAC, but rather it comes from the DAC world. F.e. its common to see an NTFS ACL (Access Control List) with DENY in it.
You might be trying to implement a merged model (see the example in my response here) - e.g. building an ACL ...
4
You could configure a modern Multi-Level Security (MLS) product to address the issue. These systems are designed for military grade data protection on shared infrastructure. Typically the systems use Role Based Access Control (RBAC), Discretionary Access Control (DAC), and Mandatory Access Control (MAC) based on security labels.
The security labels ...
4
Honestly, I wouldn't do anything (including ever connecting to their network again).
Someone set up the router and left the default password on the admin account. This same person configured it so the wifi router has no security for connections.
It seems to me either the person setting it up doesn't care at all about security of that network, or ...
4
A signature is gold standard for authenticating paperwork. Really I see this is an evolutionary artifact of progress technology. For so many years we didn't have anything better, and so it has been "grandfathered in".
I have heard of credit card companies performing automated analysis on the transaction and signature to see if it is a fraudulent ...
4
Those good old days. When I was young I copied some Spectrum games and had to work my way around copy preventions schemes.
Tape-to-tape copying is described in other answers. I was interested in digital copies for the best results.
Data on the tape in standard format was essentially just a series of bytes. With a few standard statements (LOAD, SAVE) you ...
4
This is totally dependent on your implementation details. Generally, "yes". For instance, Spring Security, a web application security infrastructure, provides a RADIUS plugin to do Auth/Auth for web applications.
If you are taking system-2-system or machine-2-machine, then again, basically "yes" again. But you will need to come up with a way (certificate, ...
4
Are you sure that there aren't any cookies available by a mobile app, often this is the case. Also this is known as horizontal privilege escalation. If you can only see details of other users I would also add user enumeration.
If you want to check how these requests are performed you can put a proxy between your phone and the internet (like ZAP or Burp)to ...
4
Online bruteforce attacks against a properly designed system is probably unfeasible against all but the weakest passwords.
This is due to the fact that online systems can implement a wide array of rate limiting techniques that will limit the number of attempts the attacker has to guess the password of a single account.
Of course there are some techniques ...
3
No, because the accountability is too low and chances are high your WPA2 password would leak out. When using RADIUS all users have their own password and usernames to authenticate to the AP.
Chances of users sharing the WPA2 password to the wifi network is larger than them sharing their own personal username and passwords. This increases security in two ...
3
Mitigation 1: Use two-factor authentication, for logging into admin accounts.
Mitigation 2: Give helpdesk staff a tablet or netbook that they can carry with them. Instead of typing their password into the user's machine, they could log into their tablet/netbook and use the internal remote administration services to administer the user's machine. Make this ...
3
I'm not aware of any built in system designed for the two-person concept at the operating system level. While a new version of sudo/PAM could be written to accomplish this, it seems to me to better enforced at the application level than the operating system level, customized in the application for your specific purposes. Data can be encrypted by multiple ...
3
This is a very good question, and it has been identified as one of the problems with RBAC. There is been a line of research on parameterized roles (the pdf can be found online), and more recently, the idea of relationship-based access control has emerged (see work of P. Fong et al, for instance this one). I'm not sure how much has been implemented though.
3
Traditional signatures are still the most widely used form of authenticity for the exchange of physical goods (think paper documents, packages, etc.) or for acknowledging an event in person. Other forms are creeping in (think chip-based credit cards, NFC, etc). This digital pad is simply a replacement to physical ink and paper and can be used to sign ...
3
The biggest problem with OAuth 1.0a in mobile and desktop applications is that the Consumer/Application key and Consumer/Application secret, which are used to sign the requests, can be extracted and exposed publicly.
For example, if you're provider of data and you create and give a consumer key to another third party web application that wants to access ...
3
This is a very broad question that can't be answered with anything near sufficiency on Stack Overflow. You really need to read a book to understand all of this. I highly recommend the Web Application Hacker's Handbook. It is an interesting and informative read.
Broadly speaking, you need to worry about people stealing or guessing the session ID. There ...
3
The 802.1x protocol is built on multiple steps.
The supplicant (entity who wants to connect) identify the Access point by its SSID as it would do for any wireless network. Be noted that 802.1x also work on traditional wired networks. For what we know, this can be any hardware that provides this SSID, it can be changed, maybe spoofed.
When you are connected ...
3
I agree with Lucas Kauffman that two-factor authentication is much better than using two passwords. What you are suggesting is not a very good design, but it is still not bad design. Always try to implement 2FA.
As for your design itself, having a different password for privileged actions could be sometimes a good idea and give you some time and flexibility ...
2
I'm not sure this is a well-known problem. If your default position is deny-to-all, and it should be, then rules should only state what each role can do. If a user/role has access to a resource under any rule at all, I would think that they should be allowed.
You might have to re-think the way your roles are laid out. I think that in conflicts, the ...
2
There is a similar pattern that Exchange 2010 is using; where the access model is limited using the "Scope" property that applies to the Binding layer. In this implementation, Scope is the "relation" between the authenticated user, and the OU that the "patient" is in.
Exchange 2010 has a delegation model where groups of winrm Powershell cmdlets are ...
2
I will simplify this problem. Cross-Site Request Forgery and Clikjacking attacks are useful because it can force a victim's browser into performing actions against the user's will.
The mention of 10.12. Cross-Site Request Forgery and 10.13. Clickjacking in the OAuth v2 RFC have fundamentally the same concern. If an attacker can force a victim's browser ...
2
If an administrator is going to type in his password on a hostile workstation, then he's effectively telling the user (or a hacker) his password, whether he sees it that way or not. This is very definitely a well-known and used exploit pathway, and I've even witnessed it used in the real world at IBM.
There's really only two options here:
Don't allow ...
2
If you don't know the key, you can't generate the HMAC. That's the whole point of a HMAC - it's a quick way to provide message integrity using existing key material. If you could regenerate the HMAC without the key, an attacker could simply generate a HMAC for a different message and alter the payload.
Only top voted, non community-wiki answers of a minimum length are eligible
