Hot answers tagged

56

According to CISSP study guide , access control include IAAA (Identification, Authentication, Authorization and Accountability). So if you dont care about the rest then you can call Authentication and Authorization as Access control. Where: Identification : User_Name Authentication : User_Name + Password ( in one factor auth , simple case) ...


8

Your school lacks some of the most basic requirements for security. Never use credentials for remote logins on a system you're not in complete control of and have full knowledge of its level of protection. Shared computers such as libraries, schools, etc. should never allow access to USB devices for boot, autoplay or execute access. All devices should be ...


8

I would say the closest thing I can think of is Authentication, Authorization, and Accounting framework, often abbreviated to AAA. Authentication, authorization, and accounting (AAA) is a term for a framework for intelligently controlling access to computer resources, enforcing policies, auditing usage, and providing the information necessary to ...


4

To ensure only the user has the key for his IMAP-Account, you can save the login credentials in your session symmetrically encrypted by a key, that is stored in a cookie. So the user can unlock the login credentials with his cookie, without that the webserver can't login. Of course you have to ensure that all occurrences of the credentials are overwritten ...


4

Since the author mentions his product is like Roundcube or Squirelmail.. I know how Roundcube works. Well, Roundcube's webmail DOES NOT have it's own method for logging in users. What I mean is that there is no database which stores anything about the user. Roundcubes takes the credentials user provided and puts them straight in imap_open(). If it ...


4

OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated. Technically, OAuth does not have to give you any information about the user. What it provides is a validation that the user has given authority to the application to access ...


4

Encryption is used to provide confidentiality of data that may or will be accessed by an untrusted entity. Access control is used to limit or otherwise control an entity's access to an object. Asking "when do we use them" is an open question. Access controls can be anything from a padlock on a gate to a permission set on a filesystem. They can be simple or ...


4

Just to add on, _optout_ can be added anywhere in the SSID not necessarily at the end. However, Google's _nomap has to be placed at the end. Yes, 802.11x will networks will not be shared through WiFi sense. Official source: Microsoft WiFi sense FAQ. Look under "I'm concerned about sharing Wi‑Fi networks. Can you tell me a little more?" Theoretically, ...


4

The user would be able to take ownership of a device by adding the device ID to a list of devices they own. What you need is some way to prove that the user is in physical possession of the device. Going by media (e.g. images, video) it sounds like you have a display of some form, therefore it would be easiest to display some temporary PIN on the ...


4

Client certificates? Set your SSL/TLS-server to reject any connection that does not present a valid Client Certificate. Related questions 2012-05-03: Advantages of client certificates for client authentication?


3

Any shared-use computer that is not under your control (and even, in certain respects, those which are) should be considered untrustworthy for any purposes beyond those which serve the organization which administers them. That means, if the computer belongs to the school, only use the system for school-related activities and only in conjunction with ...


3

In real real life, attribute certificates don't work. Nobody really supports them. One reason for that is that certificates are, by definition, an asynchronous distribution method for information: a certificate binds some values together (for a "normal" certificate, this is a name and a public key; for an attribute certificate, the holder name is bound to ...


3

Encryption mechanisms can be used to achieve specific outcomes: Making some data illegible, with the ability for specific individuals to retransform it into a legible format later: this can be used to implement confidentiality within some technical limitations Providing an authentic signature related to a specific blob of data: this can be used to provide ...


3

What I would say about the options that you outline is that HTTP Auth with SSL is a simpler but less flexible option and Oauth2 is more complex but has more flexibility in what you can achieve with it. One example, as you've noted in your ASCII art diagram, with OAuth2 it is possible to create a token which can be used in place of the password to ...


3

RFC 6750, The OAuth 2.0 Authorization Framework: Bearer Token Usage , Section 5: Security Considerations discusses some of the issues related to the use of bearer tokens. From section 5.2: 5.2. Threat Mitigation A large range of threats can be mitigated by protecting the contents of the token by using a digital signature or a Message ...


3

The only term that springs to mind as governing both is 'Access Management' With that I mean a system that implements Authentication, Authorization and Accounting. (often called an AAA framework) These terms do not really share a commonality until you start implementing a system that requires them.


2

Certificates establish authentication (tying a person to an identity), which is the wrong approach to limit access to b.example.com - a user is still themselves on both sites, and all authentication's concerned with is having them prove their identity. Limiting access is authorization, which you should do on your end by actually checking the ID contained in ...


2

Protecting the root account makes cleanup much easier: if an attacker can't tamper with the kernel or most of the programs, it's much harder to hide malicious code. It also means they can't tamper with the antivirus and other protection systems.


2

In many cases the merchant can check the amount before shipping the item. However many payment gateways implement a checksum value that is hashed with a secret key and if the hash don't match the value the transaction is aborted. There are several flaws with this approach, I gave a presentation at blackhat asia last year that illustrate some of them. You can ...


2

If an OAuth 2.0 token is compromised, you only need to concern yourself for the TTL of the token. If an HTTP Basic Auth header is compromised, the credentials do not expire. You would manually need to change your client_id and secret, and that's if you even knew or thought they were compromised. And it's likely you would need to change your client code ...


2

Generally, one time use tokens are used to mitigate replay attacks and to make it harder to steal authentication information. They have other uses in protocol design for multi-tentant and multi-user systems. I am going to assume those don't apply because you said this was a custom API built just for you. If you are calling the API over the web using ...


2

The OpenSSH format is unsurprisingly supported by OpenSSH tools. (The OpenSSH public-key format, used in authorized_keys and with a prefix added in known_hosts, isn't itself a "de jure" standard, but is a trivial modification of a public-key encoding within the SSH2 protocol which is standardized.) Less obviously, OpenSSH uses OpenSSL format(s) for private ...


2

This feels like an instance of the XY Problem. The short answer is: Your external applications Bind to your Service. This requires permission from the user, set with the permission tag. You use this secured channel to establish authorization (e.g., share a secret key for use in a symmetric key scheme). In general, this is how you provide information ...


2

The registrar verifies the identity of the user (in a comment you said that the user is not anonymous towards the registrar). Identification means that each user has some kind of unique identifier. That could be their social security number, their real name + birthday + birthplace or something like that. The registrar uses a cryptographically secure hash ...


2

To quote directly: Only use inbuilt session management. Store secondary SSO / framework / custom session identifiers in native session object – do not send as additional headers or cookies. What this is saying is that, if you've got a secondary system which doesn't/can't use inbuilt sessions, you shouldn't send that second session token as a ...


2

As a norm, you should never, EVER, EVER! put credentials on a public computer. Fortunately, big companies like Facebook, Twitter, Google allow you to revoke the account cookies and exit any ongoing sessions. Yet, there is still the risk of getting your password caught by a keylogger. If you do not mind checking your active sessions on your accounts often, ...


2

Agree 100% with other answers about not trusting the computer, but you can’t trust it even if it did require a login, as if I can touch a computer I can own it. (Put a key logger inside of the keyboard for example.) Two factor logon etc do not help much, as the computer may be connecting to a fake website, along with fake certificates. (https cannot be ...


2

Every article has an associated permissions object attached to it. That permissions object describes the code to be evaluated and any possible parameters. Most contexts are fairly normalized, such as in Facebook where the context might be friends. Thus, the viewer's control evaluates its attached rules: if you're a friend, it succeeds. That's a pretty fast ...


2

I'been digging in the Certificate field recently, and I know it's been a month since you asked, but I hope this helps you some way. In order to give each of your customers a certificate, You'll basically need a server with its own selfsigned Certificate. This server will "give" your customers their new Certificate. The flow would be something like this: 1) ...


1

Not a full answer, but another thing to think about: with a system like that the easiest way for an attacker to gain access (ie the weakest link) is to steal the private keys to one of those client certs. Things to think about: Are the linux machines physically secure, or do they leave the building (ie laptops)? Do you have good policies for certificate ...



Only top voted, non community-wiki answers of a minimum length are eligible