New answers tagged

1

Trusted party is exactly that. Someone who is trusted when he identifies you. The most basic vouching happens when you go in front of the HelpDesk and tell them that you forgot your password and are now locked out of your account. Then the IT staff vouches that it's you and resets your password. Now suppose that no domain admin was available when you went ...


0

I would say because it allows a massive increase in potential damage if one account gets hacked. Say I want to get into account A. If account A set up account B, C, and D into vouching for them, I have 3 more potential targets I could try to weasel access from. One of them is bound to have a weak password or is susceptible to social engineering. Now that I ...


0

OAuth 2 client credentials grant is designed for communications between services. Authentication for client credentials grant typically involves passing a shared secret, instead of a login/password. The shared secret is used to meet the RFC requirement of a "confidential client" for client credentials grant. If you don't already have an authentication ...


2

As @jpodwys says in his comment, HTTPS is a secure transit. It seems very unlikely to me that an attacker could steal an OAuth2 refresh token and not steal other critical information. That is, by the time you are having tokens stolen over HTTPS connections, you've already been pwned and it's game over. OAuth2 is a well-tested protocol that has many tested ...


-1

For a given length, the multiple numbers per button make it significantly harder, though by no means hard, for a casual soulder-surfer to memorize the password as they see being typed.


1

Wouldn't it depend on what actually happens when you want to input the second number on each button (I assume you press it twice)? Case 1: Two keystrokes on the same button simply outputs two of the same digit, similar to pressing the same button twice on a single number button keypad, then the result is just a reduced number of buttons, but longer code. ...


11

No, assuming equally long passcodes, having fewer buttons cannot increase security in any way. Depending on how the passcodes are chosen, and whether or not the buttons are regularly cleaned to remove smudges*, it (might or) might not decrease security significantly, but reducing the number of buttons certainly cannot make the lock more secure. So you're ...


1

Not by itself. The total number of combination is XY where X is the number of buttons, and Y is the length of the combination. For example: a 6 digits combination of 5 buttons is 56 = 15 625 combinations. a 4 digits combination of 10 buttons is 104 = 10 000 combinations. If you don't know the length of the combination, the number of buttons is ...


25

Think about the technical implementation, not about the user or what's painted on the buttons: it's a keypad with 5 buttons. In order to unlock the device, it needs a sequence of those 5 buttons (however many presses of those 5 button it allows). More buttons would make it harder to brute-force the combination. Imagine having only 2 buttons, or imagine ...


0

I've seen several web applications that implement a "sudo mode". In your example, it might look something like this: I, an admin, am logged into your application, and stay logged in for long periods of time (perhaps the session expires after 30 days). I protect this account with reasonable amount of security, but I'm not super paranoid about it. When I ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select ...


0

You open yourself up to bad user behavior at that point. Really you want to keep them safe by making sure you protect against as much bad user behavior as possible. If an admin opens the web view it makes it easier for them to forget they are in the admin area and leave without signing out of the admin area, leaving it open to someone sitting down and ...



Top 50 recent answers are included