Tag Info

New answers tagged

1

This is common practice for all rental car companies I've used in the past (Hertz, Avis, and Europcar, in various countries). The risk that your personal information might have been stolen is never zero: All risks in the information security field can only be mitigated by employing good security practices: Absolute protection doesn't exist. Moreover, the ...


0

AFAIK, They are similar WRT the end-goal. WS-Trust is SOAP-based involving front-channel (browser) and back-channel (among services) communication, SAML-Passive can optionally use SOAP for backchannel communication, SAML-P can involve no backchannel at all. The XML documents involved have different name spaces: WST vs SAML SAML-P is the name for the ...


1

An example is Italy's "Posta Certificata": a web mail that by law guarantees the recipient is a real person: https://www.postacertificata.gov.it/home/index.dot To activate it you need to go to a post office and provide an ID card. This shifts the problem to a different domain: ID cards and all their associated issues: how can we be sure that the Post ...


0

Any service you pay for has to know your billing and CC information. They also care who you are because if they stop providing service to you, they stop getting money.


3

As usual, the problem is one of definition. Namely, what makes the device 'D' more "genuine" than a PC run by some ill-intentioned individual ? If you get down to it, you will say something like: device D is genuine because that's the true piece of tangible hardware, the accumulation of atoms which came out from the factory. This is fine as far as definition ...


0

To expand on Stefan's answer: I would also ensure that the certificate used for signing is different than the one used for encryption, as well as different from the one the TLS (I hope you aren't still using SSL) is using to secure the communications channel. In other words... A unique certificate for each thing.


0

It is not specified that the certificates for two idps must be unique. As far as I know you dont even have to have a certificate. But its recommended.


2

There is a way to do this via Google's Native Client. However, executables have to be compiled for this environment explicitely. It is difficult to achieve otherwise (i.e. without a sandbox). DEP can't do this for you, as it only prevents memory segments without the executable flag from being executed. Just think of reading the CPUID, which is a simple ...


0

Hardware enforced DEP may be able to prevent, unsure about returning false values


1

This is an old question, but I've had occasion to look into this question and decided to at least look into what some and CSRF libraries use by default and my results are as follows: Django : 32 random characters from the set [a-zA-Z0-9] : 190.53 bits of entropy Ruby on Rails : 32 bytes of entropy (encoded as base64) : 256 bits of entropy Spring Security : ...



Top 50 recent answers are included