Tag Info

Hot answers tagged

28

As Phil stated, you can still use the card using its number (as you would do on-line). Also, some ATM machine won't accept the card if not able to read the magnetic strip. The best thing is to use a credit card: in that case you can block the payment and get a refund.


23

Yes, you can. On some places you can find a device called demagnetizer. Just run your card over it (or over a very strong magnet), and the magnetic track will be corrupted and you will only be able to use the chip part of the card.


14

Embossed letters are still present on CC to allow to quickly carbon-copy (literally) the card on paper. That's in the (very) old days, but still allowed today, and it will count as PRESENTIAL. Magnetic strip is still there because half of the CC readers still work that way. ATM and TPV outside USA and UE are still missing the chip reader, and even inside ...


10

YES, but there is a big chance that an (internally chip-capable) ATM (depending on region) will reject the card! The most common 2 problems for an ATM (including chip-capable) to reject a card are: a dirty or scratched magstripe (as shown in spork's answer) an erased or mangled (=invalid) magstripe by exposure to magnets or EMP (they need to emit ...


7

Don't do this, it will not work in ATM machines in my experience. I've had to get a new debit card mailed in last month because there was a little scratch out of the magnetic strip, although I had not noticed and had used it for daily chip-only and wireless transactions. It wouldn't work in any (Dutch) ATM machine afterwards (I tried my own bank's and ...


6

Disclaimer: I work for Axiomatics, the leading ABAC/XACML vendor. I am glad to hear you are sold on the philosophy of ABAC. If you haven't already done so, do check out the following resources (I'll spare you commercial links): NIST ABAC project page and report. OASIS' A brief introduction to XACML A quick intro to ABAC with XACML. Gerry Gebel's blog ...


5

How can you know who you authorise if you haven't authenticated? Authentication always comes first, except when everyone is authorised or noone is authorised. Edit: seems like you have two questions now :) 1) You were refused most likely because there is an access control policy that prevents your own original UID from performing an operation on the UID of ...


5

First things first: you are not using the correct terminology. This may be problematic if you are looking for documentation. What you call "authorization" is what the rest of the world calls "authentication". What you call "authentication" is what the rest of the world calls "session management". Authentication is about making sure that whoever is at the ...


4

OAuth provides only and should only provides authorization using an access token. OpenID connect is built on OAuth 2 in order to provide user authentication information. But will not provide you a more robust implementation than OAuth (since it uses OAuth and add some extra interactions with a OpenID provider). OpenID Connect 1.0 is a simple identity ...


4

I agree with both answers given thus far by Thomas Pornin and Steve DL. Authorization always comes after authentication since authorization is the act of looking at a given user's claims and determining whether the user can do what they are trying to do based on those claims and based on the authorization policies in place. I would like to broaden the ...


4

A claim is somewhat more arbitrary than a permission. A claim is 'blue eyes' whereas 'AddPerson' is a permission. It is an assertion from the identity provider that a given characteristic (or more accurately, an attribute) about the identity is true. You can determine permission based on claim or characteristic because 'all blue-eyed individuals can do xyz' ...


4

Your problem is a problem of authorization. SSL has nothing to do with your problem. While you must use SSL to protect your data from leaking and tampering, it will not help in any way to solve your authorization problems. Encrypting the parameters is insufficient. It will keep the common user from tampering with the parameters, but it will not stop any ...


3

Bridging the SAML and OAuth 2.0 frameworks is a well understood problem. The following stack of IETF specs provides a standard solution: If you look at the core OAuth 2.0 spec (RFC 6749) and its token endpoint definition - this is basically an OAuth server endpoint which returns an access token in exchange for a "grant" -- an open-ended concept of ...


3

ABAC and CBAC are practically the same thing. Microsoft doesn't call things attributes, but refers to them as claims because attributes tend to be associated with SAML whereas claims are mostly protocol agnostic. XACML is a model/implementation that exposes ABAC, whereas there isn't any concrete CBAC model or implementation -- not from Microsoft anyway. ...


3

Authentication is about identifying who is issuing the command, and making sure that the caller is really that person/system. Authorization occurs necessarily after, since it is about deciding whether the duly authenticated requester should be allowed to proceed or not. In your case with a su command, there are two authentication/authorization. Suppose that ...


3

Using the same key for two distinct algorithms incurs the risk of interactions. An extreme example is when you use both AES/CBC for encryption and CBC-MAC as MAC algorithm: if you use the same key for both, then it is pretty obvious that the MAC can be trivially worked around. For AES/CBC + HMAC, the gut feeling of most cryptographers is that the two ...


3

The problem with this is that in current practice, e-mail is not really a very secure channel to send this sort of information. There isn't much of a way around this, short of convincing the overwhelming mass of humanity to drastically change its e-mail habits. That's probably never going to happen, so we have to live with it as best we can. If an ...


3

OpenID and OpenID Connect are both for authentication, not for authorization. The two activities are distinct. OpenID Connect is in fact OAuth (an authorization protocol) which is turned (abused) into an authentication protocol. More explanations in this answer. To some extent you can mix authentication and authorization, but that's a source of confusion. ...


3

I have seen systems that filter by a list of allowed IP addresses first, so in order to even attempt to use an authentication method you have to be coming from a specified IP address or range. This is similar to what you are describing. But in general, authorization refers to deciding what an authenticated user can do, and so logically comes after the ...


3

There were other (non tape-related) types of copy-protection as well. I remember one game in particular called ACE that had the Lenslok copy-protection: https://en.wikipedia.org/wiki/Lenslok From Wikipedia: "The Lenslok device was essentially a row of prisms arranged vertically in a plastic holder. Before the game started, a two-letter code was displayed on ...


2

The best way to structure an ACL is as a bitmask which makes it easy to quickly determine complex access rights for a resource. The best way to store that might be a key-value store such as Redis or any object-caching technology that integrates well with your environment. The decision to go with NoSQL vs SQL would be more of a business or IT decision ...


2

Re: tokens Just use a long random string as the token. You can make it exactly as long as you want to. Why would you "encrypt" the user ID to use in the token itself? (Or am I misunderstanding something?) You can optionally also store the user IP and token expiration in the token itself, but these could just as well be in separate DB fields, if you're ...


2

Attributes are claims. A claim is simply a statement by someone/something that a user has a given attribute. That someone is the issuer which could be an IdP or an internal bit of logic that gets data from the database. This gives you way more flexibility in how you design your systems as you can specify that a given task will always require a user with a ...


2

Many people still visit this so here's a very simple diagram to explain it Courtesy Wikipedia


2

CBAC (claims-based access control) and ABAC (attribute-based access control) are essentially the same whereby a claim is an asserted "attribute". For instance, you take an attribute from Active Directory and turn it into a claim. However, there are a few issues with CBAC: first of all, it is a Microsoft-specific term, not a model per se like ABAC or RBAC. ...


2

I think RFC 2616 is quite clear: 10.4.4 403 Forbidden The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the ...


2

Well there are a couple options here. The first is to reverse it such that your user has a collection of claims that define which projects they have access to: Claims: Project: 123 Project: 124 Project: 125 Project: 129 This could be unmanageable depending on how often the projects are created and the number of projects per user as you'd have to refresh ...


2

There's no good way to restrict accounts based on network interface in Linux (by the time a packet reaches a layer that understands the concept of "account", it's forgotten which interface it came in on). However, there are two easy ways to restrict access to an application based on which interface is used: At the OS level, the iptables firewall has ...


1

This is probably not the answer you'd expected, but bear in mind that whatever solution you come up with must work for all stakeholders, including the employees who are requesting access. Who are these employees? What do they need access to? Typically, what for? You should probably talk to your colleagues and ask them, in fact. For instance, what do you do ...


1

First of all, what are you trying to do? You are explaining how you are doing it but not what is your ultimate goal. Consider revising your question to add more detail on this. That said, for the rest of this answer I'll assume that you're doing some sort of proxying (?) to mirror GIT repositories. Which sounds like a problem already solved, e.g. using git ...



Only top voted, non community-wiki answers of a minimum length are eligible