Tag Info

Hot answers tagged

26

RBAC (Role based access control) is based on defining a list of business roles, and adding each user in the system to one or more roles. Permissions and privileges are then granted to each role, and users receive them via their membership in the role (pretty much equivalent to a group). Applications will typically test the user for membership in a specific ...


16

Back then, tapes were just binary data on a magnetic film, with no "hidden" channels or out-of-band capabilities. Manufacturers that claimed to make tape-to-tape recording impossible often just made the tape look different, to deter would-be pirates. A regular tape recorder module was usually used to read them, so making "special" tapes couldn't really work. ...


11

OpenID is a protocol for authentication while OAuth is for authorization. Authentication is about making sure that the guy you are talking to is indeed who he claims to be. Authorization is about deciding what that guy should be allowed to do. In OpenID, authentication is delegated: server A wants to authenticate user U, but U's credentials (e.g. U's name ...


10

If I recall correctly, some games even managed to defeat direct tape-to-tape copying. In principle, this couldn't be possible, as the audio track on the tape contained all the information required. In practice, by using a custom loader which operated on data files encoded at a higher frequency than the standard Spectrum data files, low-quality ...


9

Well the first consideration is that SSL/TLS is absolutely necessary to implement correctly. One must also consider 2-legged or 3-legged authn mechanisms. While most are going to recommend the more complex (and safe) 3-legged approach, it is possible that 2-legged would have advantages when done right for certain apps. There have been some timing attack ...


8

One method which I have seen used: split the password. This was for SSH access to a sensitive server: a number of SSH keys were created, and marked as "authorized" on the server. Each private key was protected with a long passphrase, and every user knew only one half of the passphrase. That's crude but effective as long as there are not too many ...


8

The April 2009 "session fixation attack" is described here: http://oauth.net/advisories/2009-1/ and in more detail here: http://hueniverse.com/2009/04/explaining-the-oauth-session-fixation-attack/ Security means different things from different perspectives. As I keep repeating on this site, it all depends on your threat model. Application providers have a ...


8

Claims are a method of providing information about a user, and roles are a description of a user by way of which roles they belong. Claims are generally more useful because they can contain arbitrary data -- including role membership information. E.g. whatever is useful for the given application. Claim Based identities are more useful, but tend to be ...


8

NOPASSWD doesn't have a major impact on security. Its most obvious effect is to provide protection when the user left his workstation unattended: an attacker with physical access to his workstation can then extract data, perform actions and plant malware with the user's permissions, but not elevate his access to root. This protection is of limited use ...


7

Not really, if you want to implement a function where the administrative functions require stronger authentication you should opt for two factor authentication rather than two passwords. The reason for this is that if an attacker can get your password somehow, chances are they can also retrieve the second one.


7

OpenID connect will give you an access token plus an id token. The id token is a JWT and contains information about the authenticated user. It is signed by the identity provider and can be read and verified without accessing the identity provider. In addition, OpenID connect standardizes quite a couple things that oauth2 leaves up to choice. for instance ...


6

This is totally dependent on your implementation details. Generally, "yes". For instance, Spring Security, a web application security infrastructure, provides a RADIUS plugin to do Auth/Auth for web applications. If you are taking system-2-system or machine-2-machine, then again, basically "yes" again. But you will need to come up with a way (certificate, ...


5

It seems that you are conflating between RBAC and DAC (Discretionary Access Control): Deny Access is not typically employed in RBAC, but rather it comes from the DAC world. F.e. its common to see an NTFS ACL (Access Control List) with DENY in it. You might be trying to implement a merged model (see the example in my response here) - e.g. building an ACL ...


5

Well, by definition if some organisations are doing it, it must be feasible! More generally, all security controls have a cost and when you select a control the cost must be taken into account. Is it worth it? If so, implement it. If not, don't. Dual password control is a very powerful and effective control against loss of integrity; but as you point out ...


5

If you know what you're doing, using WCF isn't difficult. If you know what you're doing, using WCF with an STS isn't terribly difficult. If you don't know what you're doing it's all terribly difficult. Who am I kidding, it's WCF, so it's all difficult. :) Generally speaking your architecture falls into the federated trust category, as you're using the STS ...


5

You don't. You use the authentication and authorization modules provided by your framework. My goto web framework is Python's Flask framework. Flask-Login is an excellent module that provides an easy to use API that handles the bulk of the authentication work. Flask-Security is another module that encompasses Flask-Login as well as various other security ...


5

As @SteveS said, RBAC is an authorization model whereas claims are a way of providing information about a user. It generalizes the notion of a role. In the past identity servers would simply provide applications the username and the list of roles/groups. Claims generalize this such that any user attribute can be passed on to the consuming application. The ...


5

There are two specific cases why you don't want passwordless sudo: This is a defense mechanism against malicious users who gain access to an administrative account. This can either be through exploitation or due to an admin leaving his workstation unattended without locking his session. Having to re-issue the password when using sudo gives impulsive users ...


5

Disclaimer: I work for Axiomatics, the leading ABAC/XACML vendor. I am glad to hear you are sold on the philosophy of ABAC. If you haven't already done so, do check out the following resources (I'll spare you commercial links): NIST ABAC project page and report. OASIS' A brief introduction to XACML A quick intro to ABAC with XACML. Gerry Gebel's blog ...


5

How can you know who you authorise if you haven't authenticated? Authentication always comes first, except when everyone is authorised or noone is authorised. Edit: seems like you have two questions now :) 1) You were refused most likely because there is an access control policy that prevents your own original UID from performing an operation on the UID of ...


4

Online bruteforce attacks against a properly designed system is probably unfeasible against all but the weakest passwords. This is due to the fact that online systems can implement a wide array of rate limiting techniques that will limit the number of attempts the attacker has to guess the password of a single account. Of course there are some techniques ...


4

A signature is gold standard for authenticating paperwork. Really I see this is an evolutionary artifact of progress technology. For so many years we didn't have anything better, and so it has been "grandfathered in". I have heard of credit card companies performing automated analysis on the transaction and signature to see if it is a fraudulent ...


4

You will probably be interested in Wikipedia's Timeline of computer security hacker history.


4

I don't have enough points to make a comment, so I added this as an answer. OAuth is firstly an authorization protocol and not mainly an authentication. Even though authentication is embedded within the protocol, it is not the main purpose.


4

You could configure a modern Multi-Level Security (MLS) product to address the issue. These systems are designed for military grade data protection on shared infrastructure. Typically the systems use Role Based Access Control (RBAC), Discretionary Access Control (DAC), and Mandatory Access Control (MAC) based on security labels. The security labels ...


4

Send them an anonymous email/snailmail. What they do with it is their responsibility. Your conscience will be clear.


4

Honestly, I wouldn't do anything (including ever connecting to their network again). Someone set up the router and left the default password on the admin account. This same person configured it so the wifi router has no security for connections. It seems to me either the person setting it up doesn't care at all about security of that network, or ...


4

Those good old days. When I was young I copied some Spectrum games and had to work my way around copy preventions schemes. Tape-to-tape copying is described in other answers. I was interested in digital copies for the best results. Data on the tape in standard format was essentially just a series of bytes. With a few standard statements (LOAD, SAVE) you ...


4

Are you sure that there aren't any cookies available by a mobile app, often this is the case. Also this is known as horizontal privilege escalation. If you can only see details of other users I would also add user enumeration. If you want to check how these requests are performed you can put a proxy between your phone and the internet (like ZAP or Burp)to ...


4

Your phone or laptop will not necessarily automatically connect to that alternate AP, because even though it has a known SSID, it also has a MAC address which does not necessarily match the one at your home. Whether a given system will be ready to disregard the MAC address change depends on that system (from an explicit experiment at home, I can say that ...



Only top voted, non community-wiki answers of a minimum length are eligible