Tag Info

New answers tagged

2

The registrar verifies the identity of the user (in a comment you said that the user is not anonymous towards the registrar). Identification means that each user has some kind of unique identifier. That could be their social security number, their real name + birthday + birthplace or something like that. The registrar uses a cryptographically secure hash ...


1

OAuth is an authorisation protocol, providing a way to give authorisation to access a protected resource. A by-product of the authorisation process is that the user is authenticated. Technically, OAuth does not have to give you any information about the user. What it provides is a validation that the user has given authority to the application to access ...


2

Certificates establish authentication (tying a person to an identity), which is the wrong approach to limit access to b.example.com - a user is still themselves on both sites, and all authentication's concerned with is having them prove their identity. Limiting access is authorization, which you should do on your end by actually checking the ID contained in ...


0

Could someone with unfettered access to Google's systems and malicious intent compromise non-Google accounts via Google Authenticator alone? No. Could they compromise non-Google accounts via several other Google services which someone using Google authenticator is likely to also use? Probably. Firstly, Google authenticator is used to implement ...


2

To ensure only the user has the key for his IMAP-Account, you can save the login credentials in your session symmetrically encrypted by a key, that is stored in a cookie. So the user can unlock the login credentials with his cookie, without that the webserver can't login. Of course you have to ensure that all occurrences of the credentials are overwritten ...


3

Since the author mentions his product is like Roundcube or Squirelmail.. I know how Roundcube works. Well, Roundcube's webmail DOES NOT have it's own method for logging in users. What I mean is that there is no database which stores anything about the user. Roundcubes takes the credentials user provided and puts them straight in imap_open(). If it ...


0

ive been thinking about this for a bit due to the fact that you should never store user passwords in plaintext. so I have came up with a possible solution for you. When a user signs up for a new 'service' to their account (e.g. they add gmail or yahoo, etc. ) what you are going to have to do is: Ask the user for their site password again (and validate ...


0

Why you do not store the mail server credentials as part of the web server session data. Once the user type his mail server username and password in you webmail client application. You keep this information in the web server/user session. However, this means every time the user login to the webmail he will need to authenticate his identity at least twice ...



Top 50 recent answers are included