Hot answers tagged

56

According to CISSP study guide , access control include IAAA (Identification, Authentication, Authorization and Accountability). So if you dont care about the rest then you can call Authentication and Authorization as Access control. Where: Identification : User_Name Authentication : User_Name + Password ( in one factor auth , simple case) ...


25

Think about the technical implementation, not about the user or what's painted on the buttons: it's a keypad with 5 buttons. In order to unlock the device, it needs a sequence of those 5 buttons (however many presses of those 5 button it allows). More buttons would make it harder to brute-force the combination. Imagine having only 2 buttons, or imagine ...


11

No, assuming equally long passcodes, having fewer buttons cannot increase security in any way. Depending on how the passcodes are chosen, and whether or not the buttons are regularly cleaned to remove smudges*, it (might or) might not decrease security significantly, but reducing the number of buttons certainly cannot make the lock more secure. So you're ...


8

I would say the closest thing I can think of is Authentication, Authorization, and Accounting framework, often abbreviated to AAA. Authentication, authorization, and accounting (AAA) is a term for a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to ...


8

Your school lacks some of the most basic requirements for security. Never use credentials for remote logins on a system you're not in complete control of and have full knowledge of its level of protection. Shared computers such as libraries, schools, etc. should never allow access to USB devices for boot, autoplay or execute access. All devices should be ...


7

The main advantage of a refresh token is that it is easier to detect if it is compromised. Consider these two scenarios: A single long-lasting auth token is used. A short duration auth token is used, and a long-lasting refresh token periodically requests a new auth token once the previous one has expired. In scenario 1, if the auth token is compromised ...


7

1.What is the difference between authentication and authorization? Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, when the user gives the username and a password, while the server checks these credentials (username, password) with those stored in its database, when the first ...


5

I didn't read all the details you wrote, I just want to make a general observation: you're planning on re-implementing part of an existing standard. Most likely, in a few months you'll realize you need another feature and you'll have to re-implement some more of that standard. Unless you're a genius cryptographer with a dedicated team of reviewers, there's a ...


5

Lets look at some different attacks and how they impact the two different systems, followed by some usability considerations. Control of phone (draw) If the attacker has full controll over the phone, it is game over no matter what. However, an attacker may have been able to get a trojan onto ther phone that only has limited permissions. At least on Android,...


4

Just to add on, _optout_ can be added anywhere in the SSID not necessarily at the end. However, Google's _nomap has to be placed at the end. Yes, 802.11x will networks will not be shared through WiFi sense. Official source: Microsoft WiFi sense FAQ. Look under "I'm concerned about sharing Wi‑Fi networks. Can you tell me a little more?" Theoretically, ...


4

The user would be able to take ownership of a device by adding the device ID to a list of devices they own. What you need is some way to prove that the user is in physical possession of the device. Going by media (e.g. images, video) it sounds like you have a display of some form, therefore it would be easiest to display some temporary PIN on the device ...


4

Client certificates? Set your SSL/TLS-server to reject any connection that does not present a valid Client Certificate. Related questions 2012-05-03: Advantages of client certificates for client authentication?


4

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. In those cases sending just the token isn't sufficient. Sites that use the Authorization : Bearer cn389ncoiwuencr format are most likely implementing ...


4

RFC 6750, The OAuth 2.0 Authorization Framework: Bearer Token Usage , Section 5: Security Considerations discusses some of the issues related to the use of bearer tokens. From section 5.2: 5.2. Threat Mitigation A large range of threats can be mitigated by protecting the contents of the token by using a digital signature or a Message ...


4

It all comes down to the old adage: "Good IT security is hard". While none of the concerns are known by us here to be fatal (we can't know your whole business and client model), they do raise serious doubts or at least things to really think hard about, and are worth taking soberly. Flip it round and look at your users' perspective. You are asking your ...


4

The inherent problem is that the computers are untrusted - multiple passwords going through the same untrusted channel won't really help, and may confuse your clients more than help them. I would strongly suggest adding a second factor authentication via a trusted channel like your client's smart phone. 2FA does not have to be onerous or complicated. Begin ...


3

The only term that springs to mind as governing both is 'Access Management' With that I mean a system that implements Authentication, Authorization and Accounting. (often called an AAA framework) These terms do not really share a commonality until you start implementing a system that requires them.


3

Any shared-use computer that is not under your control (and even, in certain respects, those which are) should be considered untrustworthy for any purposes beyond those which serve the organization which administers them. That means, if the computer belongs to the school, only use the system for school-related activities and only in conjunction with ...


3

In real real life, attribute certificates don't work. Nobody really supports them. One reason for that is that certificates are, by definition, an asynchronous distribution method for information: a certificate binds some values together (for a "normal" certificate, this is a name and a public key; for an attribute certificate, the holder name is bound to ...


3

Looks like I found the answer on Access Token: UserInfo Endpoint It should be noted that clients are not required to use the access token, since the ID Token contains all the necessary information for processing the authentication event. However, in order to provide compatibility with OAuth and match the general tendency for authorizing ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select "...


3

They may or may not be using token based authorization, and they may or may not be timing out sessions. The reason they never ask you to log in again is entirely separate, and for convenience. Users don't want to log in over and over again, and apps that make them cause them to be unhappy, and being unhappy causes them to give the apps bad ratings, and bad ...


3

Is there any reason to not do this? Yes, I think of two reasons not to do it: The user may mistakenly enter in their full-access password into a compromised machine. Once a user enters their lower-access password into a compromised machine, now the attacker potentially knows a username and can try to brute-force the other password. This gives the ...


2

Bear in mind that when you enable third-party account authentication in your application it is because you're delegating Identification AND Authentication to that third-party, that you choose to trust. For instance, if the user chooses to login to your application using a third party account, your application doesn't have to be aware when the user changes ...


2

The OpenSSH format is unsurprisingly supported by OpenSSH tools. (The OpenSSH public-key format, used in authorized_keys and with a prefix added in known_hosts, isn't itself a "de jure" standard, but is a trivial modification of a public-key encoding within the SSH2 protocol which is standardized.) Less obviously, OpenSSH uses OpenSSL format(s) for private ...


2

Every article has an associated permissions object attached to it. That permissions object describes the code to be evaluated and any possible parameters. Most contexts are fairly normalized, such as in Facebook where the context might be friends. Thus, the viewer's control evaluates its attached rules: if you're a friend, it succeeds. That's a pretty fast ...


2

Agree 100% with other answers about not trusting the computer, but you can’t trust it even if it did require a login, as if I can touch a computer I can own it. (Put a key logger inside of the keyboard for example.) Two factor logon etc do not help much, as the computer may be connecting to a fake website, along with fake certificates. (https cannot be ...


2

As a norm, you should never, EVER, EVER! put credentials on a public computer. Fortunately, big companies like Facebook, Twitter, Google allow you to revoke the account cookies and exit any ongoing sessions. Yet, there is still the risk of getting your password caught by a keylogger. If you do not mind checking your active sessions on your accounts often, ...


2

This feels like an instance of the XY Problem. The short answer is: Your external applications Bind to your Service. This requires permission from the user, set with the permission tag. You use this secured channel to establish authorization (e.g., share a secret key for use in a symmetric key scheme). In general, this is how you provide information ...


2

I'been digging in the Certificate field recently, and I know it's been a month since you asked, but I hope this helps you some way. In order to give each of your customers a certificate, You'll basically need a server with its own selfsigned Certificate. This server will "give" your customers their new Certificate. The flow would be something like this: 1) ...



Only top voted, non community-wiki answers of a minimum length are eligible