Tag Info

New answers tagged

0

The "OT" in "HOTP" means "one-time". This is true only if the server indeed rejects passwords corresponding to a counter value which is not greater than the last confirmed value. Having "a little margin" here would mean accepting that a given password is accepted twice, the very thing that HOTP tries to prevent. This is all based on the idea that the HOTP ...


2

I think RFC 2616 is quite clear: 10.4.4 403 Forbidden The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the ...


0

As Guido points out in his comment, it largely depends on the target system. If the target system has clearly defined APIs / interfaces you can protect, then XACML would make more sense (XACML has an architecture whereby a policy enforcement point intercepts a flow and sends off an authorization request to a policy decision point). If, on the other hand, ...


4

Disclaimer: I work for Axiomatics, the leading ABAC/XACML vendor. I am glad to hear you are sold on the philosophy of ABAC. If you haven't already done so, do check out the following resources (I'll spare you commercial links): NIST ABAC project page and report. OASIS' A brief introduction to XACML A quick intro to ABAC with XACML. Gerry Gebel's blog ...


0

The security of this depends on how exactly you do the encryption. If you are using CBC-mode and no integrity checking, then I see a weakness that could allow one user of your app to impersonate another user: The attacker gets legitimately issued a token for their own Facebook account. They then wait 48 hours so the token is invalid. If they present this ...


3

Using the same key for two distinct algorithms incurs the risk of interactions. An extreme example is when you use both AES/CBC for encryption and CBC-MAC as MAC algorithm: if you use the same key for both, then it is pretty obvious that the MAC can be trivially worked around. For AES/CBC + HMAC, the gut feeling of most cryptographers is that the two ...



Top 50 recent answers are included