Tag Info

New answers tagged

0

I wouldn't consider this a major security issue as the values are limited to only your system's access to the third party sites. It is less desirable, but the values can be easily invalidated without any bleeding in to other systems that access the same services. It certainly doesn't hurt, and is even wise, to encrypt it, but you would have to encrypt it ...


0

I think there is some confusion about the access token and how it is used which can cause a security problem. It is correct that the tokens can be a security risk, but this depends on the information you are asking for from the service. A friends list is more information than first and last name for instance, but that information is not as vital as personal ...


2

OAuth can be used in many different ways. If an OAuth tokens is being issued to your web application using your secret key (making your web application into the 'client'), then no one should access this token, rather the role of your web service is to perform actions on behalf of other clients and your application must have access control in place. ...


1

You should use DPAPI to encrypt the data before storing it in Isolated Storage. While DPAPI is mostly targeted at per-user security, not per-app, it does have some provisions for your scenario: A small drawback to using the logon password is that all applications running under the same user can access any protected data that they know about. Of ...


1

Technically you can store the access token in your database, and use it for API calls until it expires. It might be more trouble than its worth, though. For one thing, as Jonathan notes in his comment above, now you have to worry about securing your database and the data in it - these tokens give access to some fairly privileged information about your ...


0

What would be the point of hashing the accessToken? We hash passwords because people reuse them everywhere. If they would not reuse passwords, we would not need to hash passwords, the application has been hacked after all (as the attacker gained access to the db), so all is already lost. accessTokens are not reused. and adding to security, are only used ...


2

In my understanding, "less secure apps" refers to applications that send your credentials directly to Gmail. Lots of things can go wrong when you give your credentials to third party to give to the authentication authority: the third party might keep the credentials in storage without telling you, they might use your credentials for purposes outside the ...


0

People are using mobile apps that do not take proper actions to secure GMail users credentials. So Google is taking the only thing it can do: ending malicious hackers fun by forbidding apps from throwing users and passwords around and forcing the use of an authentication method that it trusts (their own!). The problem with these apps is not one, but ...


0

Auth tokens only really seem to make sense to me when their lifespan is kept short. As far as I can tell, this scheme does not alter the fact that an intercepted token can be replayed which would seem to be the problem with all simple token-based approaches? (or maybe it is just late and I've not read it properly :) Certainly, I'd want to make sure that ...



Top 50 recent answers are included