Tag Info

Hot answers tagged

26

RBAC (Role based access control) is based on defining a list of business roles, and adding each user in the system to one or more roles. Permissions and privileges are then granted to each role, and users receive them via their membership in the role (pretty much equivalent to a group). Applications will typically test the user for membership in a specific ...


16

Back then, tapes were just binary data on a magnetic film, with no "hidden" channels or out-of-band capabilities. Manufacturers that claimed to make tape-to-tape recording impossible often just made the tape look different, to deter would-be pirates. A regular tape recorder module was usually used to read them, so making "special" tapes couldn't really work. ...


10

If I recall correctly, some games even managed to defeat direct tape-to-tape copying. In principle, this couldn't be possible, as the audio track on the tape contained all the information required. In practice, by using a custom loader which operated on data files encoded at a higher frequency than the standard Spectrum data files, low-quality ...


9

Well the first consideration is that SSL/TLS is absolutely necessary to implement correctly. One must also consider 2-legged or 3-legged authn mechanisms. While most are going to recommend the more complex (and safe) 3-legged approach, it is possible that 2-legged would have advantages when done right for certain apps. There have been some timing attack ...


8

One method which I have seen used: split the password. This was for SSH access to a sensitive server: a number of SSH keys were created, and marked as "authorized" on the server. Each private key was protected with a long passphrase, and every user knew only one half of the passphrase. That's crude but effective as long as there are not too many ...


8

The April 2009 "session fixation attack" is described here: http://oauth.net/advisories/2009-1/ and in more detail here: http://hueniverse.com/2009/04/explaining-the-oauth-session-fixation-attack/ Security means different things from different perspectives. As I keep repeating on this site, it all depends on your threat model. Application providers have a ...


8

Claims are a method of providing information about a user, and roles are a description of a user by way of which roles they belong. Claims are generally more useful because they can contain arbitrary data -- including role membership information. E.g. whatever is useful for the given application. Claim Based identities are more useful, but tend to be ...


7

Not really, if you want to implement a function where the administrative functions require stronger authentication you should opt for two factor authentication rather than two passwords. The reason for this is that if an attacker can get your password somehow, chances are they can also retrieve the second one.


7

NOPASSWD doesn't have a major impact on security. Its most obvious effect is to provide protection when the user left his workstation unattended: an attacker with physical access to his workstation can then extract data, perform actions and plant malware with the user's permissions, but not elevate his access to root. This protection is of limited use ...


5

Well, by definition if some organisations are doing it, it must be feasible! More generally, all security controls have a cost and when you select a control the cost must be taken into account. Is it worth it? If so, implement it. If not, don't. Dual password control is a very powerful and effective control against loss of integrity; but as you point out ...


5

It seems that you are conflating between RBAC and DAC (Discretionary Access Control): Deny Access is not typically employed in RBAC, but rather it comes from the DAC world. F.e. its common to see an NTFS ACL (Access Control List) with DENY in it. You might be trying to implement a merged model (see the example in my response here) - e.g. building an ACL ...


5

OpenID connect will give you an access token plus an id token. The id token is a JWT and contains information about the authenticated user. It is signed by the identity provider and can be read and verified without accessing the identity provider. In addition, OpenID connect standardizes quite a couple things that oauth2 leaves up to choice. for instance ...


5

If you know what you're doing, using WCF isn't difficult. If you know what you're doing, using WCF with an STS isn't terribly difficult. If you don't know what you're doing it's all terribly difficult. Who am I kidding, it's WCF, so it's all difficult. :) Generally speaking your architecture falls into the federated trust category, as you're using the STS ...


5

You don't. You use the authentication and authorization modules provided by your framework. My goto web framework is Python's Flask framework. Flask-Login is an excellent module that provides an easy to use API that handles the bulk of the authentication work. Flask-Security is another module that encompasses Flask-Login as well as various other security ...


5

OpenID is a protocol for authentication while OAuth is for authorization. Authentication is about making sure that the guy you are talking to is indeed who he claims to be. Authorization is about deciding what that guy should be allowed to do. In OpenID, authentication is delegated: server A wants to authenticate user U, but U's credentials (e.g. U's name ...


5

As @SteveS said, RBAC is an authorization model whereas claims are a way of providing information about a user. It generalizes the notion of a role. In the past identity servers would simply provide applications the username and the list of roles/groups. Claims generalize this such that any user attribute can be passed on to the consuming application. The ...


5

There are two specific cases why you don't want passwordless sudo: This is a defense mechanism against malicious users who gain access to an administrative account. This can either be through exploitation or due to an admin leaving his workstation unattended without locking his session. Having to re-issue the password when using sudo gives impulsive users ...


4

Honestly, I wouldn't do anything (including ever connecting to their network again). Someone set up the router and left the default password on the admin account. This same person configured it so the wifi router has no security for connections. It seems to me either the person setting it up doesn't care at all about security of that network, or ...


4

A signature is gold standard for authenticating paperwork. Really I see this is an evolutionary artifact of progress technology. For so many years we didn't have anything better, and so it has been "grandfathered in". I have heard of credit card companies performing automated analysis on the transaction and signature to see if it is a fraudulent ...


4

You could configure a modern Multi-Level Security (MLS) product to address the issue. These systems are designed for military grade data protection on shared infrastructure. Typically the systems use Role Based Access Control (RBAC), Discretionary Access Control (DAC), and Mandatory Access Control (MAC) based on security labels. The security labels ...


4

Those good old days. When I was young I copied some Spectrum games and had to work my way around copy preventions schemes. Tape-to-tape copying is described in other answers. I was interested in digital copies for the best results. Data on the tape in standard format was essentially just a series of bytes. With a few standard statements (LOAD, SAVE) you ...


4

This is totally dependent on your implementation details. Generally, "yes". For instance, Spring Security, a web application security infrastructure, provides a RADIUS plugin to do Auth/Auth for web applications. If you are taking system-2-system or machine-2-machine, then again, basically "yes" again. But you will need to come up with a way (certificate, ...


4

Are you sure that there aren't any cookies available by a mobile app, often this is the case. Also this is known as horizontal privilege escalation. If you can only see details of other users I would also add user enumeration. If you want to check how these requests are performed you can put a proxy between your phone and the internet (like ZAP or Burp)to ...


4

Online bruteforce attacks against a properly designed system is probably unfeasible against all but the weakest passwords. This is due to the fact that online systems can implement a wide array of rate limiting techniques that will limit the number of attempts the attacker has to guess the password of a single account. Of course there are some techniques ...


4

Your phone or laptop will not necessarily automatically connect to that alternate AP, because even though it has a known SSID, it also has a MAC address which does not necessarily match the one at your home. Whether a given system will be ready to disregard the MAC address change depends on that system (from an explicit experiment at home, I can say that ...


4

First things first: you are not using the correct terminology. This may be problematic if you are looking for documentation. What you call "authorization" is what the rest of the world calls "authentication". What you call "authentication" is what the rest of the world calls "session management". Authentication is about making sure that whoever is at the ...


3

No, because the accountability is too low and chances are high your WPA2 password would leak out. When using RADIUS all users have their own password and usernames to authenticate to the AP. Chances of users sharing the WPA2 password to the wifi network is larger than them sharing their own personal username and passwords. This increases security in two ...


3

Mitigation 1: Use two-factor authentication, for logging into admin accounts. Mitigation 2: Give helpdesk staff a tablet or netbook that they can carry with them. Instead of typing their password into the user's machine, they could log into their tablet/netbook and use the internal remote administration services to administer the user's machine. Make this ...


3

I will simplify this problem. Cross-Site Request Forgery and Clikjacking attacks are useful because it can force a victim's browser into performing actions against the user's will. The mention of 10.12. Cross-Site Request Forgery and 10.13. Clickjacking in the OAuth v2 RFC have fundamentally the same concern. If an attacker can force a victim's browser ...


3

I'm not sure this is a well-known problem. If your default position is deny-to-all, and it should be, then rules should only state what each role can do. If a user/role has access to a resource under any rule at all, I would think that they should be allowed. You might have to re-think the way your roles are laid out. I think that in conflicts, the ...



Only top voted, non community-wiki answers of a minimum length are eligible