Tag Info

Hot answers tagged

25

I like the idea, but I too have many questions left open. Please do not see this as any form of bashing, because I wrote it trying to apply my authentication experience to this new scheme. I am concerned about (in no particular order) : Unauthorized use of the private key Rich client support (Outlook, Notes, etc.) Using from multiple computers Private ...


19

I guess there is no really good solution for everday websites (e. g. not high profile sites such as banks for which users accept and economic allows a two factor authentication). One can only pick a solution which as little negative impact as possible. Unfortunately people are not good at remembering a huge number of passwords. This results in either them ...


15

From a security perspective, having a tried and tested mechanism is almost always better than rolling your own. Implementation errors are one of the most common ways a good security concept gets broken. From a usability perspective I slightly prefer oauth, it is just easy to use, so for your end users that is a huge benefit. An average non-technical user is ...


12

Without a specific scenario and threat model in mind it is hard to answer your question. But one clear win is the classic OAuth use case. It turns out users are amazingly willing to give one web site their password for another web site, e.g. their Google password to a social networking site like Shelfari. And as Kalsey notes, they were sometimes horribly ...


12

You are correct. App secret should be secret and should not be easily obtained by reverse engineering your client code. Facebook uses OAuth so everything I say here also applies to all the applications that use OAuth to authorize and authenticate. The app secret authenticates your client to facebook. Just like a username/password authenticates a user to a ...


11

Stack exchange also has a detailed comparison of BrowserId and WebID. As argued there BrowserId is very close to WebID (a W3C Incubator Group at the W3C). Here are some points that need to be made in defence of both protocols usually as they are very different from how public key cryptography is usually done. Unauthorized script use of key. Agree that ...


9

The OAuth RFC states: OAuth uses tokens to represent the authorization granted to the client by the resource owner. Typically, token credentials are issued by the server at the resource owner's request, after authenticating the resource owner's identity (usually using a username and password). There are many ways in which a ...


9

PCI DSS v2, Requirement 7: "Implement Strong Access Control Measures" is the pertinent section. This section details access control primarily for non-consumers that will be accessing cardholder data for business purposes, though there are a couple requirements that seem applicable to consumers as well as non-consumers: 8.1 Assign all users a unique ID ...


9

OAuth and OpenID don't send your password to the sites you use OAuth/OpenID providers to login with, so no. Not unless the attack is performed on the OAuth/OpenID provider and provider's servers are vulnerable to CVE-2014-0160 (The Heartbleed Bug). It is however possible, of course provided that sites you're logging into using OAuth/OpenID providers are ...


8

I haven't found a way to comment on the accepted answer, so I'm submitting a response to those six points as a new answer. Sorry. 1. Unauthorized use of the private key In the case of the Javascript BrowserID implementation, the private key is stored in local storage under the login.persona.org domain. So a rogue script would have to be hosted on that ...


8

Wrote this about federated ID. Basically you are talking about the centralized risk problem or keys to the kingdom. This also applies to password managers, but securing a small number of identity and authentication systems is a lot easier and more effective than having hundreds of weak passwords (or the same weak password a hundred times). Open-ID providers ...


8

State Parameter The scope parameter is not used to secure the authentication request against CSRF attacks (see below). But there is another parameter called "state", which matches your description. [Asking the user] This step cannot be skipped. I am afraid, this assumption is not correct. It is very common, that the user is only asked for permission, ...


7

From having conducted many an IT audit over the last ten years or so, I would say my biggest worry would be gaining assurance that this third party authentication mechanism works as it should. An auditor who puts their neck on the line and green-lights this is in a very sticky position if something happens at the facebook/twitter end of things (they are ...


7

Rather than logging in to accounts they control, I expect voter fraud would be done by clickjacking or CSRF, harnessing the social viral power of Facebook to attract unwitting accomplices. With the prevalence lately of images on Facebook that claim that you can obtain a PS4 simply by "liking" and "sharing" an image and the sheer numbers of people who do so, ...


6

One disadvantage of BrowserID in its current form compared to some of the alternatives is that anything beyond the core functionality is difficult: further discovery of information requires other protocols such as WebFinger, whereas e.g. an OpenID URL can provide links. For instance, it is difficult to get a display name or profile picture from BrowserID ...


6

This does depend on your situation, but the short answer is don't re-invent the wheel if you don't have to. If you can take advantage of OAuth/OpenID (stackoverflow does) then you probably should. This can be more for connivence then security, sites will offer OpenID but allow you to create a login if you don't already have one (so as to cover all bases). ...


6

There is absolutely nothing in the OpenID/OAuth authentication methods that guarantees an individual signing-in through them is indeed a unique user. OpenID provides a bit more data in a form of a certificate (user name, email address, and notary) than OAuth's valet key authentication, but that alone isn't enough to prevent voting fraud. Using the word fraud ...


5

For more extensive information on BrowserId/Persona, I eventually found what Daniel contributed to the related Q&A on BrowserId/Persona and WebID. (I tried to convince him to post here, but he suggested I do so.) Security, Privacy and Usability Requirements for Federated Identity by Michael Hackett and Kirstie Hawkey provides a comparison between ...


5

Having 1 password stored in 1000 servers is less secure than 1 password stored in 1 server which authenticates 999 servers is less secure than 1000 password for 1000 servers. However the latter is impractical, people aren't capable of remembering 1000 password for 1000 servers, the only way they do that is to use password managers. And where does password ...


5

OpenID connect will give you an access token plus an id token. The id token is a JWT and contains information about the authenticated user. It is signed by the identity provider and can be read and verified without accessing the identity provider. In addition, OpenID connect standardizes quite a couple things that oauth2 leaves up to choice. for instance ...


5

OpenID is a protocol for authentication while OAuth is for authorization. Authentication is about making sure that the guy you are talking to is indeed who he claims to be. Authorization is about deciding what that guy should be allowed to do. In OpenID, authentication is delegated: server A wants to authenticate user U, but U's credentials (e.g. U's name ...


4

The original question asks if Facebook, Twitter, etc authentication schemes are PCI-compliant. The Payment Card Industry (PCI) Data Security Standards (DSS) specification cites two separate and distinct things about authentication and it is the context of use that discriminates between the requirements: Section 8 states that a unique ID must be assigned to ...


4

One thing to consider if you're considering relying on Twitter/Facebook for authentication is that both of them still allow for session IDs to be transmited over an unencrypted connection as, after authentication, they are accessed over http and not https. As such they're unlikely to be considered to be in-line with PCI requirements.


4

Unlike the resource owner credentials, tokens can be issued with a restricted scope and limited lifetime, and revoked independently. from http://tools.ietf.org/html/rfc5849 I guess the RFC has also example, but I did browse it entirely. The oauth site also feature some code, maybe it can help you, http://oauth.net/code/


4

So typically is is exactly the sort of problem that OAuth was designed to avoid, not create. You, as a resource provider, have created a system that you have decided to protect with OAuth, and a WordPress plugin that acts as a client to your system. Bob, who has a WordPress site and who would like to use your system, installs the plugin into his ...


4

First of all insure that each OAuth provider actually verifies the users email address. Google and Facebook do this, but not every site will verify your email address (reddit is an example). Google and Facebook are on the ball when it comes to security, and I doubt they will be the weakest link. However, defense in depth is admirable quality. A simple ...


3

It's a good to have option for the end-users, although the protocol does not mandate this possibility. Imagine the following scenario: The end-user starts to use an application that wants to access his google account data. So the end-user is redirected to google to approve the request. Once he approves the request, google issues access token to the third ...


3

One way OAuth and OpenID improves security is that it makes you have to type your password less often. Linking a new account to OAuth/OpenID is just me being redirected to the identity provider, and since I'm already logged in to the identity provider all the time, it simply gives a Yes/No prompt instead of a password prompt. No password travels throughout ...


3

#2 is absolutely true but not primarily a problem of federal id, only that it is even more critical in this case. You have similar problems with all login forms embedded in (actually) untrusted content, especially because the used authentication is the most insecure(secret is simply transmitted by the browser, and if you're lucky the server puts SSL ...



Only top voted, non community-wiki answers of a minimum length are eligible