Hot answers tagged

56

According to CISSP study guide , access control include IAAA (Identification, Authentication, Authorization and Accountability). So if you dont care about the rest then you can call Authentication and Authorization as Access control. Where: Identification : User_Name Authentication : User_Name + Password ( in one factor auth , simple case) ...


25

Think about the technical implementation, not about the user or what's painted on the buttons: it's a keypad with 5 buttons. In order to unlock the device, it needs a sequence of those 5 buttons (however many presses of those 5 button it allows). More buttons would make it harder to brute-force the combination. Imagine having only 2 buttons, or imagine ...


11

No, assuming equally long passcodes, having fewer buttons cannot increase security in any way. Depending on how the passcodes are chosen, and whether or not the buttons are regularly cleaned to remove smudges*, it (might or) might not decrease security significantly, but reducing the number of buttons certainly cannot make the lock more secure. So you're ...


8

Your school lacks some of the most basic requirements for security. Never use credentials for remote logins on a system you're not in complete control of and have full knowledge of its level of protection. Shared computers such as libraries, schools, etc. should never allow access to USB devices for boot, autoplay or execute access. All devices should be ...


8

I would say the closest thing I can think of is Authentication, Authorization, and Accounting framework, often abbreviated to AAA. Authentication, authorization, and accounting (AAA) is a term for a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to ...


6

The main advantage of a refresh token is that it is easier to detect if it is compromised. Consider these two scenarios: A single long-lasting auth token is used. A short duration auth token is used, and a long-lasting refresh token periodically requests a new auth token once the previous one has expired. In scenario 1, if the auth token is compromised ...


6

1.What is the difference between authentication and authorization? Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, when the user gives the username and a password, while the server checks these credentials (username, password) with those stored in its database, when the first ...


5

I didn't read all the details you wrote, I just want to make a general observation: you're planning on re-implementing part of an existing standard. Most likely, in a few months you'll realize you need another feature and you'll have to re-implement some more of that standard. Unless you're a genius cryptographer with a dedicated team of reviewers, there's a ...


5

Lets look at some different attacks and how they impact the two different systems, followed by some usability considerations. Control of phone (draw) If the attacker has full controll over the phone, it is game over no matter what. However, an attacker may have been able to get a trojan onto ther phone that only has limited permissions. At least on ...


4

The user would be able to take ownership of a device by adding the device ID to a list of devices they own. What you need is some way to prove that the user is in physical possession of the device. Going by media (e.g. images, video) it sounds like you have a display of some form, therefore it would be easiest to display some temporary PIN on the ...


4

Just to add on, _optout_ can be added anywhere in the SSID not necessarily at the end. However, Google's _nomap has to be placed at the end. Yes, 802.11x will networks will not be shared through WiFi sense. Official source: Microsoft WiFi sense FAQ. Look under "I'm concerned about sharing Wi‑Fi networks. Can you tell me a little more?" Theoretically, ...


4

RFC 6750, The OAuth 2.0 Authorization Framework: Bearer Token Usage , Section 5: Security Considerations discusses some of the issues related to the use of bearer tokens. From section 5.2: 5.2. Threat Mitigation A large range of threats can be mitigated by protecting the contents of the token by using a digital signature or a Message ...


4

Client certificates? Set your SSL/TLS-server to reject any connection that does not present a valid Client Certificate. Related questions 2012-05-03: Advantages of client certificates for client authentication?


4

It all comes down to the old adage: "Good IT security is hard". While none of the concerns are known by us here to be fatal (we can't know your whole business and client model), they do raise serious doubts or at least things to really think hard about, and are worth taking soberly. Flip it round and look at your users' perspective. You are asking your ...


3

The only term that springs to mind as governing both is 'Access Management' With that I mean a system that implements Authentication, Authorization and Accounting. (often called an AAA framework) These terms do not really share a commonality until you start implementing a system that requires them.


3

Any shared-use computer that is not under your control (and even, in certain respects, those which are) should be considered untrustworthy for any purposes beyond those which serve the organization which administers them. That means, if the computer belongs to the school, only use the system for school-related activities and only in conjunction with ...


3

In real real life, attribute certificates don't work. Nobody really supports them. One reason for that is that certificates are, by definition, an asynchronous distribution method for information: a certificate binds some values together (for a "normal" certificate, this is a name and a public key; for an attribute certificate, the holder name is bound to ...


3

Looks like I found the answer on Access Token: UserInfo Endpoint It should be noted that clients are not required to use the access token, since the ID Token contains all the necessary information for processing the authentication event. However, in order to provide compatibility with OAuth and match the general tendency for authorizing ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select ...


2

Bear in mind that when you enable third-party account authentication in your application it is because you're delegating Identification AND Authentication to that third-party, that you choose to trust. For instance, if the user chooses to login to your application using a third party account, your application doesn't have to be aware when the user changes ...


2

The OpenSSH format is unsurprisingly supported by OpenSSH tools. (The OpenSSH public-key format, used in authorized_keys and with a prefix added in known_hosts, isn't itself a "de jure" standard, but is a trivial modification of a public-key encoding within the SSH2 protocol which is standardized.) Less obviously, OpenSSH uses OpenSSL format(s) for private ...


2

As a norm, you should never, EVER, EVER! put credentials on a public computer. Fortunately, big companies like Facebook, Twitter, Google allow you to revoke the account cookies and exit any ongoing sessions. Yet, there is still the risk of getting your password caught by a keylogger. If you do not mind checking your active sessions on your accounts often, ...


2

Every article has an associated permissions object attached to it. That permissions object describes the code to be evaluated and any possible parameters. Most contexts are fairly normalized, such as in Facebook where the context might be friends. Thus, the viewer's control evaluates its attached rules: if you're a friend, it succeeds. That's a pretty fast ...


2

Agree 100% with other answers about not trusting the computer, but you can’t trust it even if it did require a login, as if I can touch a computer I can own it. (Put a key logger inside of the keyboard for example.) Two factor logon etc do not help much, as the computer may be connecting to a fake website, along with fake certificates. (https cannot be ...


2

Long before bearer authorization, this header was used for Basic authentication. For interoperability, the use of these headers is governed by W3C norms, so even if you're reading and writing the header, you should follow them. Bearer distinguishes the type of Authorization you're using, so it's important.


2

This feels like an instance of the XY Problem. The short answer is: Your external applications Bind to your Service. This requires permission from the user, set with the permission tag. You use this secured channel to establish authorization (e.g., share a secret key for use in a symmetric key scheme). In general, this is how you provide information ...


2

I'been digging in the Certificate field recently, and I know it's been a month since you asked, but I hope this helps you some way. In order to give each of your customers a certificate, You'll basically need a server with its own selfsigned Certificate. This server will "give" your customers their new Certificate. The flow would be something like this: 1) ...


2

This is a the classic problem. I've been interested in this for some time now and I'm not aware of any standard model that really solves it out of the box (yet). RBAC can be adapted to work for your situation by introducing parameters. There are several names that these adaptions go by, the most common is parameterized RBAC (pRBAC). I've also seen names ...


2

There's really no good way to even securely guarantee that a client is what it says it is, so there's really no point in trying to make each redirect URI unique to a single client. The only reason why you register URIs to begin with is to prevent the open redirect scenario mentioned in the documentation, which would make it trivial to say, configure an evil ...


2

The two options are distinct in the following way: The company sends the SMS to the customer The customer sends the SMS to the company If we think carefully about how identity is verified in telephone networks, we will discover the core security issue the leads companies to choose option 1. Whenever you place a call or send an SMS, you know what number ...



Only top voted, non community-wiki answers of a minimum length are eligible