Reputation
657
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 7 16
Impact
~95k people reached

Aug
21
awarded  Autobiographer
Jun
29
awarded  Yearling
Feb
28
awarded  Popular Question
Feb
3
comment Best place to store authentication tokens client side
@jfamvg I'm not suggesting you don't store a token on the client, I'm saying don't store the private access token there. Generate a public token and send that instead.
Feb
3
awarded  Explainer
Feb
3
comment How secure is a password app that stores both the password and two factor secret in one place?
Why would you even store a OTP? Given it's 2-step verification this is generated every time and only valid for that single communication. Regardless, it seems to me that you are pretty much rending the 2-factor security redundant if your storing both under a "master" password.
Feb
3
revised Best place to store authentication tokens client side
Updated title
Feb
3
answered Best place to store authentication tokens client side
Feb
3
comment Best place to store authentication tokens client side
In what way will SSL help secure a token stored on the client?
Feb
3
suggested approved edit on Best place to store authentication tokens client side
Feb
1
awarded  Famous Question
Jan
30
revised Token-based authentication - Securing the token
added 14 characters in body
Jan
24
answered Securing a multi-tenant, multi-database REST API
Jan
13
revised What is the common practice to encrypt user's personal identifiable information
deleted 12 characters in body
Jan
7
comment Token-based authentication - Securing the token
@Plinio.Santos I think an RSA key would be fine, I imagine it's just as secure as a PRNG key, the important points of the key is A. it can't be replicated easily & B. it's kept secret. The secret key has to be distinct per user otherwise all users would also have the same public key and there would be no distinction between user tokens.
Jan
7
comment Token-based authentication - Securing the token
@Elisa the token is already a HMAC and that's what you would store.
Jan
4
answered What is the common practice to encrypt user's personal identifiable information
Jan
1
revised Public key authentication: what gets signed?
deleted 6 characters in body; deleted 5 characters in body; deleted 8 characters in body
Jan
1
revised Public key authentication: what gets signed?
added 599 characters in body
Jan
1
awarded  Teacher