New answers tagged identity
As usual, the problem is one of definition. Namely, what makes the device 'D' more "genuine" than a PC run by some ill-intentioned individual ? If you get down to it, you will say something like: device D is genuine because that's the true piece of tangible hardware, the accumulation of atoms which came out from the factory. This is fine as far as definition ...
To expand on Stefan's answer: I would also ensure that the certificate used for signing is different than the one used for encryption, as well as different from the one the TLS (I hope you aren't still using SSL) is using to secure the communications channel. In other words... A unique certificate for each thing.
It is not specified that the certificates for two idps must be unique. As far as I know you dont even have to have a certificate. But its recommended.
There is a way to do this via Google's Native Client. However, executables have to be compiled for this environment explicitely. It is difficult to achieve otherwise (i.e. without a sandbox). DEP can't do this for you, as it only prevents memory segments without the executable flag from being executed. Just think of reading the CPUID, which is a simple ...
Hardware enforced DEP may be able to prevent, unsure about returning false values
This is an old question, but I've had occasion to look into this question and decided to at least look into what some and CSRF libraries use by default and my results are as follows: Django : 32 random characters from the set [a-zA-Z0-9] : 190.53 bits of entropy Ruby on Rails : 32 bytes of entropy (encoded as base64) : 256 bits of entropy Spring Security : ...
Top 50 recent answers are included