Tag Info

New answers tagged

1

The Sebastian answer was terrific. I will restate that in layman's terms. The SecureID token is simply a clock with a seed value in it. Instead of displaying time it displays a number. The dot in that we can see in the picture is seconds (I think), the bar is when the number is going to change so you can time it. If it is reaching the bottom it is about to ...


16

Yes it does work as you say. The chip is "tamper resistant" and will erase the "seed" (secret key) if any attempt is made to attack it. This is often accomplished by having a non-user-replaceable battery and a "trap" that breaks Power to the device once the device is opened, or the chip Surface is removed. The key is then stored in a SRAM, requiring Power to ...


3

The SecurID token has a "seed" value assigned to it, and is programmed with a specific algorithm that generates numbers based on the seed and its system clock. The seed value is also stored in a file that is shipped with the token. Upon receiving the token, System Administrators import the seed file to the authentication server. Since the SecurID token ...


1

I see two possible attack vectors. eavesdropping cross site scripting vulnerabilities in your web application When the token isn't transmitted via HTTPS, it can be intercepted and used by an eavesdropper. To prevent this, enforce https for all communication. When the HTML document includes any data from a 3rd party, you need to be weary of XSS ...


2

Sorry, I can't "Comment", have to create an "Answer". This is what you are looking for: "Subresource Integrity" http://w3c.github.io/webappsec/specs/subresourceintegrity/ Summary: http://qnimate.com/how-to-make-browsers-verify-fetched-resources-content/ Subresource integrity is only supported by the latest browsers.


0

I firmly believe in a completely separate login/logout page. It's better for conveying to the user they have been logged out. If only one part of the page changes, then it would be easy to overlook if a user didn't successfully log out.


0

Encrypt the content using a session key while in transit. Decrypt the content in-memory using a variable. At logout, explicity clear the variables containing keys and decrypted information. Also explicity clear any variables containing authentication information and any information that was used to generate the session key. The session key can be generated ...



Top 50 recent answers are included