557 reputation
2615
bio website
location Glasgow, United Kingdom
age
visits member for 2 years, 9 months
seen Mar 27 at 17:17

Feb
28
awarded  Popular Question
Feb
3
comment Best place to store authentication tokens client side
@jfamvg I'm not suggesting you don't store a token on the client, I'm saying don't store the private access token there. Generate a public token and send that instead.
Feb
3
awarded  Explainer
Feb
3
comment How secure is a password app that stores both the password and two factor secret in one place?
Why would you even store a OTP? Given it's 2-step verification this is generated every time and only valid for that single communication. Regardless, it seems to me that you are pretty much rending the 2-factor security redundant if your storing both under a "master" password.
Feb
3
revised Best place to store authentication tokens client side
Updated title
Feb
3
answered Best place to store authentication tokens client side
Feb
3
comment Best place to store authentication tokens client side
In what way will SSL help secure a token stored on the client?
Feb
3
suggested approved edit on Best place to store authentication tokens client side
Feb
1
awarded  Famous Question
Jan
30
revised Token-based authentication - Securing the token
added 14 characters in body
Jan
24
answered Securing a multi-tenant, multi-database REST API
Jan
13
revised What is the common practice to encrypt user's personal identifiable information
deleted 12 characters in body
Jan
7
comment Token-based authentication - Securing the token
@Plinio.Santos I think an RSA key would be fine, I imagine it's just as secure as a PRNG key, the important points of the key is A. it can't be replicated easily & B. it's kept secret. The secret key has to be distinct per user otherwise all users would also have the same public key and there would be no distinction between user tokens.
Jan
7
comment Token-based authentication - Securing the token
@Elisa the token is already a HMAC and that's what you would store.
Jan
4
answered What is the common practice to encrypt user's personal identifiable information
Jan
1
revised Public key authentication: what gets signed?
deleted 6 characters in body; deleted 5 characters in body; deleted 8 characters in body
Jan
1
revised Public key authentication: what gets signed?
added 599 characters in body
Jan
1
awarded  Teacher
Jan
1
answered Public key authentication: what gets signed?
Dec
16
comment Token-based authentication - Securing the token
Couple of things - who said I wasn't utilising the authorization header? Token authentication is still stateless, the server remembers nothing beyond the current request - the token is simply used as a ticket to say "hey, I've been before, he's the proof, so you can skip the authentication step".