Tag Info

Hot answers tagged

2

In many cases the merchant can check the amount before shipping the item. However many payment gateways implement a checksum value that is hashed with a secret key and if the hash don't match the value the transaction is aborted. There are several flaws with this approach, I gave a presentation at blackhat asia last year that illustrate some of them. You can ...


2

What I would say about the options that you outline is that HTTP Auth with SSL is a simpler but less flexible option and Oauth2 is more complex but has more flexibility in what you can achieve with it. One example, as you've noted in your ASCII art diagram, with OAuth2 it is possible to create a token which can be used in place of the password to ...


1

is it really necessary worrying about superusers? My gut feeling says no: in princible whathever the encryption method a superuser can read all the files and ultimately any kind of keys of the users; Kind of. Even if the file is encrypted and the decryption is only done within the process the superuser has on most systems access to the process memory ...


1

If an OAuth 2.0 token is compromised, you only need to concern yourself for the TTL of the token. If an HTTP Basic Auth header is compromised, the credentials do not expire. You would manually need to change your client_id and secret, and that's if you even knew or thought they were compromised. And it's likely you would need to change your client code ...



Only top voted, non community-wiki answers of a minimum length are eligible