Hot answers tagged authorization
17
RBAC (Role based access control) is based on defining a list of business roles, and adding each user in the system to one or more roles. Permissions and privileges are then granted to each role, and users receive them via their membership in the role (pretty much equivalent to a group). Applications will typically test the user for membership in a specific ...
16
Back then, tapes were just binary data on a magnetic film, with no "hidden" channels or out-of-band capabilities. Manufacturers that claimed to make tape-to-tape recording impossible often just made the tape look different, to deter would-be pirates. A regular tape recorder module was usually used to read them, so making "special" tapes couldn't really work.
...
10
If I recall correctly, some games even managed to defeat direct tape-to-tape copying.
In principle, this couldn't be possible, as the audio track on the tape contained all the information required. In practice, by using a custom loader which operated on data files encoded at a higher frequency than the standard Spectrum data files, low-quality ...
8
One method which I have seen used: split the password. This was for SSH access to a sensitive server: a number of SSH keys were created, and marked as "authorized" on the server. Each private key was protected with a long passphrase, and every user knew only one half of the passphrase.
That's crude but effective as long as there are not too many ...
8
The April 2009 "session fixation attack" is described here: http://oauth.net/advisories/2009-1/ and in more detail here: http://hueniverse.com/2009/04/explaining-the-oauth-session-fixation-attack/
Security means different things from different perspectives. As I keep repeating on this site, it all depends on your threat model. Application providers have a ...
7
Well the first consideration is that SSL/TLS is absolutely necessary to implement correctly.
One must also consider 2-legged or 3-legged authn mechanisms. While most are going to recommend the more complex (and safe) 3-legged approach, it is possible that 2-legged would have advantages when done right for certain apps.
There have been some timing attack ...
5
Well, by definition if some organisations are doing it, it must be feasible!
More generally, all security controls have a cost and when you select a control the cost must be taken into account. Is it worth it? If so, implement it. If not, don't.
Dual password control is a very powerful and effective control against loss of integrity; but as you point out ...
4
It seems that you are conflating between RBAC and DAC (Discretionary Access Control): Deny Access is not typically employed in RBAC, but rather it comes from the DAC world. F.e. its common to see an NTFS ACL (Access Control List) with DENY in it.
You might be trying to implement a merged model (see the example in my response here) - e.g. building an ACL ...
4
You could configure a modern Multi-Level Security (MLS) product to address the issue. These systems are designed for military grade data protection on shared infrastructure. Typically the systems use Role Based Access Control (RBAC), Discretionary Access Control (DAC), and Mandatory Access Control (MAC) based on security labels.
The security labels ...
4
Honestly, I wouldn't do anything (including ever connecting to their network again).
Someone set up the router and left the default password on the admin account. This same person configured it so the wifi router has no security for connections.
It seems to me either the person setting it up doesn't care at all about security of that network, or ...
4
A signature is gold standard for authenticating paperwork. Really I see this is an evolutionary artifact of progress technology. For so many years we didn't have anything better, and so it has been "grandfathered in".
I have heard of credit card companies performing automated analysis on the transaction and signature to see if it is a fraudulent ...
4
Those good old days. When I was young I copied some Spectrum games and had to work my way around copy preventions schemes.
Tape-to-tape copying is described in other answers. I was interested in digital copies for the best results.
Data on the tape in standard format was essentially just a series of bytes. With a few standard statements (LOAD, SAVE) you ...
4
This is totally dependent on your implementation details. Generally, "yes". For instance, Spring Security, a web application security infrastructure, provides a RADIUS plugin to do Auth/Auth for web applications.
If you are taking system-2-system or machine-2-machine, then again, basically "yes" again. But you will need to come up with a way (certificate, ...
3
No, because the accountability is too low and chances are high your WPA2 password would leak out. When using RADIUS all users have their own password and usernames to authenticate to the AP.
Chances of users sharing the WPA2 password to the wifi network is larger than them sharing their own personal username and passwords. This increases security in two ...
3
Mitigation 1: Use two-factor authentication, for logging into admin accounts.
Mitigation 2: Give helpdesk staff a tablet or netbook that they can carry with them. Instead of typing their password into the user's machine, they could log into their tablet/netbook and use the internal remote administration services to administer the user's machine. Make this ...
3
I'm not aware of any built in system designed for the two-person concept at the operating system level. While a new version of sudo/PAM could be written to accomplish this, it seems to me to better enforced at the application level than the operating system level, customized in the application for your specific purposes. Data can be encrypted by multiple ...
3
This is a very good question, and it has been identified as one of the problems with RBAC. There is been a line of research on parameterized roles (the pdf can be found online), and more recently, the idea of relationship-based access control has emerged (see work of P. Fong et al, for instance this one). I'm not sure how much has been implemented though.
3
Traditional signatures are still the most widely used form of authenticity for the exchange of physical goods (think paper documents, packages, etc.) or for acknowledging an event in person. Other forms are creeping in (think chip-based credit cards, NFC, etc). This digital pad is simply a replacement to physical ink and paper and can be used to sign ...
3
The biggest problem with OAuth 1.0a in mobile and desktop applications is that the Consumer/Application key and Consumer/Application secret, which are used to sign the requests, can be extracted and exposed publicly.
For example, if you're provider of data and you create and give a consumer key to another third party web application that wants to access ...
3
This is a very broad question that can't be answered with anything near sufficiency on Stack Overflow. You really need to read a book to understand all of this. I highly recommend the Web Application Hacker's Handbook. It is an interesting and informative read.
Broadly speaking, you need to worry about people stealing or guessing the session ID. There ...
3
The 802.1x protocol is built on multiple steps.
The supplicant (entity who wants to connect) identify the Access point by its SSID as it would do for any wireless network. Be noted that 802.1x also work on traditional wired networks. For what we know, this can be any hardware that provides this SSID, it can be changed, maybe spoofed.
When you are connected ...
2
I'm not sure this is a well-known problem. If your default position is deny-to-all, and it should be, then rules should only state what each role can do. If a user/role has access to a resource under any rule at all, I would think that they should be allowed.
You might have to re-think the way your roles are laid out. I think that in conflicts, the ...
2
There is a similar pattern that Exchange 2010 is using; where the access model is limited using the "Scope" property that applies to the Binding layer. In this implementation, Scope is the "relation" between the authenticated user, and the OU that the "patient" is in.
Exchange 2010 has a delegation model where groups of winrm Powershell cmdlets are ...
2
If you don't know the key, you can't generate the HMAC. That's the whole point of a HMAC - it's a quick way to provide message integrity using existing key material. If you could regenerate the HMAC without the key, an attacker could simply generate a HMAC for a different message and alter the payload.
2
If an administrator is going to type in his password on a hostile workstation, then he's effectively telling the user (or a hacker) his password, whether he sees it that way or not. This is very definitely a well-known and used exploit pathway, and I've even witnessed it used in the real world at IBM.
There's really only two options here:
Don't allow ...
2
AAA is a concept and an actual software implementation of AAA is in the RADIUS protocol.
Remote Authentication Dial In User Service (RADIUS) is a networking
protocol that provides centralized Authentication, Authorization, and
Accounting (AAA) management for computers to connect and use a network
service. RADIUS was developed by Livingston ...
2
Yes, basic client software and server software can be RADIUS clients and can authenticate themselves against RADIUS.
For example, FreeRADIUS server offers the Apache RADIUS authentication module that allows any Apache web-server to become a RADIUS client for authentication and accounting requests.
You can integrate RADIUS client functionality by using ...
1
It simply means that the magnetic stripe on the card is unreadable, or the reader itself is broken or gummed up. There are 2 tracks on the magnetic stripe on a credit card, track 2 in this case is damaged or perhaps simply covered with some sort of dirt or dust. Try cleaning the card and/or the reader.
From a security perspective it could be that this ...
1
I use Spring Security extensively, but it's intended to solve a different set of problems than the ones you cited: registration, change-password, reset. You'll still need to handle all that yourself. Spring Security is a very effective tool for handling authentication, authorization, and access-control.
1
I will simplify this problem. Cross-Site Request Forgery and Clikjacking attacks are useful because it can force a victim's browser into performing actions against the user's will.
The mention of 10.12. Cross-Site Request Forgery and 10.13. Clickjacking in the OAuth v2 RFC have fundamentally the same concern. If an attacker can force a victim's browser ...
Only top voted, non community-wiki answers of a minimum length are eligible
