Hot answers tagged

56

According to CISSP study guide , access control include IAAA (Identification, Authentication, Authorization and Accountability). So if you dont care about the rest then you can call Authentication and Authorization as Access control. Where: Identification : User_Name Authentication : User_Name + Password ( in one factor auth , simple case) ...


8

I would say the closest thing I can think of is Authentication, Authorization, and Accounting framework, often abbreviated to AAA. Authentication, authorization, and accounting (AAA) is a term for a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to ...


8

Your school lacks some of the most basic requirements for security. Never use credentials for remote logins on a system you're not in complete control of and have full knowledge of its level of protection. Shared computers such as libraries, schools, etc. should never allow access to USB devices for boot, autoplay or execute access. All devices should be ...


6

1.What is the difference between authentication and authorization? Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, when the user gives the username and a password, while the server checks these credentials (username, password) with those stored in its database, when the first ...


5

The main advantage of a refresh token is that it is easier to detect if it is compromised. Consider these two scenarios: A single long-lasting auth token is used. A short duration auth token is used, and a long-lasting refresh token periodically requests a new auth token once the previous one has expired. In scenario 1, if the auth token is compromised ...


5

I didn't read all the details you wrote, I just want to make a general observation: you're planning on re-implementing part of an existing standard. Most likely, in a few months you'll realize you need another feature and you'll have to re-implement some more of that standard. Unless you're a genius cryptographer with a dedicated team of reviewers, there's a ...


5

Lets look at some different attacks and how they impact the two different systems, followed by some usability considerations. Control of phone (draw) If the attacker has full controll over the phone, it is game over no matter what. However, an attacker may have been able to get a trojan onto ther phone that only has limited permissions. At least on ...


4

Just to add on, _optout_ can be added anywhere in the SSID not necessarily at the end. However, Google's _nomap has to be placed at the end. Yes, 802.11x will networks will not be shared through WiFi sense. Official source: Microsoft WiFi sense FAQ. Look under "I'm concerned about sharing Wi‑Fi networks. Can you tell me a little more?" Theoretically, ...


4

Encryption is used to provide confidentiality of data that may or will be accessed by an untrusted entity. Access control is used to limit or otherwise control an entity's access to an object. Asking "when do we use them" is an open question. Access controls can be anything from a padlock on a gate to a permission set on a filesystem. They can be simple or ...


4

Client certificates? Set your SSL/TLS-server to reject any connection that does not present a valid Client Certificate. Related questions 2012-05-03: Advantages of client certificates for client authentication?


4

The user would be able to take ownership of a device by adding the device ID to a list of devices they own. What you need is some way to prove that the user is in physical possession of the device. Going by media (e.g. images, video) it sounds like you have a display of some form, therefore it would be easiest to display some temporary PIN on the ...


4

It all comes down to the old adage: "Good IT security is hard". While none of the concerns are known by us here to be fatal (we can't know your whole business and client model), they do raise serious doubts or at least things to really think hard about, and are worth taking soberly. Flip it round and look at your users' perspective. You are asking your ...


3

RFC 6750, The OAuth 2.0 Authorization Framework: Bearer Token Usage , Section 5: Security Considerations discusses some of the issues related to the use of bearer tokens. From section 5.2: 5.2. Threat Mitigation A large range of threats can be mitigated by protecting the contents of the token by using a digital signature or a Message ...


3

The only term that springs to mind as governing both is 'Access Management' With that I mean a system that implements Authentication, Authorization and Accounting. (often called an AAA framework) These terms do not really share a commonality until you start implementing a system that requires them.


3

Any shared-use computer that is not under your control (and even, in certain respects, those which are) should be considered untrustworthy for any purposes beyond those which serve the organization which administers them. That means, if the computer belongs to the school, only use the system for school-related activities and only in conjunction with ...


3

In real real life, attribute certificates don't work. Nobody really supports them. One reason for that is that certificates are, by definition, an asynchronous distribution method for information: a certificate binds some values together (for a "normal" certificate, this is a name and a public key; for an attribute certificate, the holder name is bound to ...


3

Encryption mechanisms can be used to achieve specific outcomes: Making some data illegible, with the ability for specific individuals to retransform it into a legible format later: this can be used to implement confidentiality within some technical limitations Providing an authentic signature related to a specific blob of data: this can be used to provide ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select ...


2

Generally, one time use tokens are used to mitigate replay attacks and to make it harder to steal authentication information. They have other uses in protocol design for multi-tentant and multi-user systems. I am going to assume those don't apply because you said this was a custom API built just for you. If you are calling the API over the web using ...


2

The OpenSSH format is unsurprisingly supported by OpenSSH tools. (The OpenSSH public-key format, used in authorized_keys and with a prefix added in known_hosts, isn't itself a "de jure" standard, but is a trivial modification of a public-key encoding within the SSH2 protocol which is standardized.) Less obviously, OpenSSH uses OpenSSL format(s) for private ...


2

As a norm, you should never, EVER, EVER! put credentials on a public computer. Fortunately, big companies like Facebook, Twitter, Google allow you to revoke the account cookies and exit any ongoing sessions. Yet, there is still the risk of getting your password caught by a keylogger. If you do not mind checking your active sessions on your accounts often, ...


2

To quote directly: Only use inbuilt session management. Store secondary SSO / framework / custom session identifiers in native session object – do not send as additional headers or cookies. What this is saying is that, if you've got a secondary system which doesn't/can't use inbuilt sessions, you shouldn't send that second session token as a ...


2

I'been digging in the Certificate field recently, and I know it's been a month since you asked, but I hope this helps you some way. In order to give each of your customers a certificate, You'll basically need a server with its own selfsigned Certificate. This server will "give" your customers their new Certificate. The flow would be something like this: 1) ...


2

This feels like an instance of the XY Problem. The short answer is: Your external applications Bind to your Service. This requires permission from the user, set with the permission tag. You use this secured channel to establish authorization (e.g., share a secret key for use in a symmetric key scheme). In general, this is how you provide information ...


2

Every article has an associated permissions object attached to it. That permissions object describes the code to be evaluated and any possible parameters. Most contexts are fairly normalized, such as in Facebook where the context might be friends. Thus, the viewer's control evaluates its attached rules: if you're a friend, it succeeds. That's a pretty fast ...


2

Agree 100% with other answers about not trusting the computer, but you can’t trust it even if it did require a login, as if I can touch a computer I can own it. (Put a key logger inside of the keyboard for example.) Two factor logon etc do not help much, as the computer may be connecting to a fake website, along with fake certificates. (https cannot be ...


2

Looks like I found the answer on Access Token: UserInfo Endpoint It should be noted that clients are not required to use the access token, since the ID Token contains all the necessary information for processing the authentication event. However, in order to provide compatibility with OAuth and match the general tendency for authorizing ...


2

This is a the classic problem. I've been interested in this for some time now and I'm not aware of any standard model that really solves it out of the box (yet). RBAC can be adapted to work for your situation by introducing parameters. There are several names that these adaptions go by, the most common is parameterized RBAC (pRBAC). I've also seen names ...


2

There's really no good way to even securely guarantee that a client is what it says it is, so there's really no point in trying to make each redirect URI unique to a single client. The only reason why you register URIs to begin with is to prevent the open redirect scenario mentioned in the documentation, which would make it trivial to say, configure an evil ...



Only top voted, non community-wiki answers of a minimum length are eligible