New answers tagged

0

Humans always want to transfer their responsibilities from their shoulders(Not everyone). Security is a great responsibility and most businesses want to focus on the core business and give their customers best of their product rather than worrying about the security. Single point of failure is definitely something to worry from a security perspective but ...


1

I had a similar problem to solve, but from a URL in SMS (simple logon, without username/password). So I generate one time code for it, but you can as well use the existing token (you need to know the keys of course to decrypt or validate it). You can find details of my approach here with an answer on how secure that approach is. So you can always generate ...


0

JSON and OAuth are used in conjunction but are two different things. While JSON is a format for structuring data, OAuth is spec that allows users to share the private resources on one website with another site without sharing the credentials. OAuth has not been designed as authentication protocol but rather as a "delegated authorization protocol". It can be ...


-1

This makes no sense. There is an interesting basic difference between passwords and TOTP/HOTP. TOTP is a symmetric algorithm. The server and the client share the same information. They share the OTP secret key, the synchronized time and the last timecounter to avoid replay. In contrast the password authentication mechanism does not share information. The ...


0

OAuth 2 client credentials grant is designed for communications between services. Authentication for client credentials grant typically involves passing a shared secret, instead of a login/password. The shared secret is used to meet the RFC requirement of a "confidential client" for client credentials grant. If you don't already have an authentication ...


2

Taking a look at the specific source code piece(GoogleDrive.java) that handles credential file creation/initialization, I found this: Line 449: /** Directory to store user credentials. */ private final java.io.File DATA_STORE_DIR; Line 473: public GoogleDrive(Properties configuration) { DATA_STORE_DIR = new java.io.File("data/google/" + ...


2

As @jpodwys says in his comment, HTTPS is a secure transit. It seems very unlikely to me that an attacker could steal an OAuth2 refresh token and not steal other critical information. That is, by the time you are having tokens stolen over HTTPS connections, you've already been pwned and it's game over. OAuth2 is a well-tested protocol that has many tested ...


0

Rate-Limit the API calls. Make sure every installation gets a unique ID (see UUID). Limit the calls to your API per UUID and IP to a strict limit. But be careful: sometimes, multiple legit users use the same IP address. So you should set your limit to about 2-3 times of what a single client will consume.


1

With OAuth (including OAuth2 or OpenID for that matter) you would still have a local user entity. Where you store information about this user is up to you. In the case of your example, you would create a user table in your database, just as you normally would. What is different is that you do not store authentication information (such as passwords1) in your ...



Top 50 recent answers are included