Hot answers tagged authorization
16
Back then, tapes were just binary data on a magnetic film, with no "hidden" channels or out-of-band capabilities. Manufacturers that claimed to make tape-to-tape recording impossible often just made the tape look different, to deter would-be pirates. A regular tape recorder module was usually used to read them, so making "special" tapes couldn't really work.
...
10
If I recall correctly, some games even managed to defeat direct tape-to-tape copying.
In principle, this couldn't be possible, as the audio track on the tape contained all the information required. In practice, by using a custom loader which operated on data files encoded at a higher frequency than the standard Spectrum data files, low-quality ...
8
One method which I have seen used: split the password. This was for SSH access to a sensitive server: a number of SSH keys were created, and marked as "authorized" on the server. Each private key was protected with a long passphrase, and every user knew only one half of the passphrase.
That's crude but effective as long as there are not too many ...
5
Well, by definition if some organisations are doing it, it must be feasible!
More generally, all security controls have a cost and when you select a control the cost must be taken into account. Is it worth it? If so, implement it. If not, don't.
Dual password control is a very powerful and effective control against loss of integrity; but as you point out ...
4
Honestly, I wouldn't do anything (including ever connecting to their network again).
Someone set up the router and left the default password on the admin account. This same person configured it so the wifi router has no security for connections.
It seems to me either the person setting it up doesn't care at all about security of that network, or ...
4
A signature is gold standard for authenticating paperwork. Really I see this is an evolutionary artifact of progress technology. For so many years we didn't have anything better, and so it has been "grandfathered in".
I have heard of credit card companies performing automated analysis on the transaction and signature to see if it is a fraudulent ...
4
This is totally dependent on your implementation details. Generally, "yes". For instance, Spring Security, a web application security infrastructure, provides a RADIUS plugin to do Auth/Auth for web applications.
If you are taking system-2-system or machine-2-machine, then again, basically "yes" again. But you will need to come up with a way (certificate, ...
4
Those good old days. When I was young I copied some Spectrum games and had to work my way around copy preventions schemes.
Tape-to-tape copying is described in other answers. I was interested in digital copies for the best results.
Data on the tape in standard format was essentially just a series of bytes. With a few standard statements (LOAD, SAVE) you ...
3
No, because the accountability is too low and chances are high your WPA2 password would leak out. When using RADIUS all users have their own password and usernames to authenticate to the AP.
Chances of users sharing the WPA2 password to the wifi network is larger than them sharing their own personal username and passwords. This increases security in two ...
3
This is a very broad question that can't be answered with anything near sufficiency on Stack Overflow. You really need to read a book to understand all of this. I highly recommend the Web Application Hacker's Handbook. It is an interesting and informative read.
Broadly speaking, you need to worry about people stealing or guessing the session ID. There ...
3
Traditional signatures are still the most widely used form of authenticity for the exchange of physical goods (think paper documents, packages, etc.) or for acknowledging an event in person. Other forms are creeping in (think chip-based credit cards, NFC, etc). This digital pad is simply a replacement to physical ink and paper and can be used to sign ...
3
I'm not aware of any built in system designed for the two-person concept at the operating system level. While a new version of sudo/PAM could be written to accomplish this, it seems to me to better enforced at the application level than the operating system level, customized in the application for your specific purposes. Data can be encrypted by multiple ...
3
Mitigation 1: Use two-factor authentication, for logging into admin accounts.
Mitigation 2: Give helpdesk staff a tablet or netbook that they can carry with them. Instead of typing their password into the user's machine, they could log into their tablet/netbook and use the internal remote administration services to administer the user's machine. Make this ...
3
The 802.1x protocol is built on multiple steps.
The supplicant (entity who wants to connect) identify the Access point by its SSID as it would do for any wireless network. Be noted that 802.1x also work on traditional wired networks. For what we know, this can be any hardware that provides this SSID, it can be changed, maybe spoofed.
When you are connected ...
2
If you don't know the key, you can't generate the HMAC. That's the whole point of a HMAC - it's a quick way to provide message integrity using existing key material. If you could regenerate the HMAC without the key, an attacker could simply generate a HMAC for a different message and alter the payload.
2
If an administrator is going to type in his password on a hostile workstation, then he's effectively telling the user (or a hacker) his password, whether he sees it that way or not. This is very definitely a well-known and used exploit pathway, and I've even witnessed it used in the real world at IBM.
There's really only two options here:
Don't allow ...
2
Yes, basic client software and server software can be RADIUS clients and can authenticate themselves against RADIUS.
For example, FreeRADIUS server offers the Apache RADIUS authentication module that allows any Apache web-server to become a RADIUS client for authentication and accounting requests.
You can integrate RADIUS client functionality by using ...
2
AAA is a concept and an actual software implementation of AAA is in the RADIUS protocol.
Remote Authentication Dial In User Service (RADIUS) is a networking
protocol that provides centralized Authentication, Authorization, and
Accounting (AAA) management for computers to connect and use a network
service. RADIUS was developed by Livingston ...
1
Here are a few things to think about:
For mobile apps: do you stored the user's password on the device? At that point you add risk in case the device is stolen. If you use some form of token based authentication, you store the token and not the password - given how users reuse passwords, any chance to reduce the chance of exposure is good.
I wouldn't call ...
1
Your question is essentially one about DRM.
I can't really make out one important fact about the tool. Is this tool hosted on your own servers or your clients servers?
If the tool is hosted on your own servers, this makes the situation a lot easier. Setup a authorization system based on API keys and only allow clients to use the tool if an accepted API key ...
1
MAC addressing resides in Layer 2 of the OSI model. Most of file sharing protocols are way up in Layer 7. I doubt you can do what you're trying to do only using MAC addresses.
It is possible to transfer anything using any layer of the OSI model. You can get physical and send the files bit by bit by yourself through the wire. You can even write an ...
1
There are common defects in authentication systems that should be avoided:
In a corporate environment it is important to terminate
authentication immediately. If an employee is fired they could seek
revenge, and even a narrow window of access cloud be enough to cause
serious monetary loss.
Bruteforce. There must be a system in place to rate-limit ...
1
I think this can be implemented using Capabilities. Every subject has a set of pairs (o,r) where o is the object and r are the rights. For example if Customer1 can read file1, and read-write on file2, you can have a Capability list like that:
Customer1={(file1,{read}),(file2,{read,write})}
If many Customers have the same rights you may use groups to limit ...
1
It simply means that the magnetic stripe on the card is unreadable, or the reader itself is broken or gummed up. There are 2 tracks on the magnetic stripe on a credit card, track 2 in this case is damaged or perhaps simply covered with some sort of dirt or dust. Try cleaning the card and/or the reader.
From a security perspective it could be that this ...
1
I use Spring Security extensively, but it's intended to solve a different set of problems than the ones you cited: registration, change-password, reset. You'll still need to handle all that yourself. Spring Security is a very effective tool for handling authentication, authorization, and access-control.
1
I will simplify this problem. Cross-Site Request Forgery and Clikjacking attacks are useful because it can force a victim's browser into performing actions against the user's will.
The mention of 10.12. Cross-Site Request Forgery and 10.13. Clickjacking in the OAuth v2 RFC have fundamentally the same concern. If an attacker can force a victim's browser ...
1
Not that I know of on a command-by-command basis, though you could simulate it by using sudo with two-factor authentication (eg, yubikey), and give one factor to each keyholder.
But I did have a client that wanted something like this in an overarching sense, so we installed tripwire on the relevant boxes. The sysadmins had the sudo powers to run it, but ...
1
While it may be an issue if you have restrictions on adding software, it'd be relatively simple to write a version of 'su' (here's the bones of a conventional implementation).
It would be possible to implement 2 user authentication as a pam module, but I don't think you could stack it with other modules providing authentication - hence using a single ...
1
Supposing you at least hash+salt the password of your users in the database, your workflow seems correct.
But I'd like to add two things :
DON'T PUT THE USER'S PASSWORD IN THE TOKEN, it's not secure at all and totally useless. The expiration_date is also useless here. Just put a sha1(username + 'randomly generated string') and you will be good.
If the ...
1
Comparing DCOM to RPC is much like comparing HTTP to TCP.
In fact, DCOM actually uses RPC as the transport mechanism, when it is necessary to send the DCOM requests over the network.
RPC, as a transport protocol, does not have any built-in authentication mechanisms; DCOM has authentication as part of the protocol.
So, for Windows 2000, when the full ...
Only top voted, non community-wiki answers of a minimum length are eligible
