Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
1 8
Newest
 Caucus
Impact
~7k people reached

  • 0 posts edited
  • 0 helpful flags
  • 2 votes cast
Jul
24
awarded  Caucus
Apr
23
comment Should I create one key pair per customer as Service Provider in SAML?
There is only one SP and that is the Web application I work on.
Apr
22
comment Should I create one key pair per customer as Service Provider in SAML?
Exactly. I think my question wasn't too good. I hope my edit clarifies a lot.
Apr
22
revised Should I create one key pair per customer as Service Provider in SAML?
major clarifications
Apr
22
comment Should I create one key pair per customer as Service Provider in SAML?
Thanks. No doubt using unique keys is a pain. I just wasn't sure if this opens up obvious security risks. I agree that the IdP is responsible for their key management. I'm not familiar with Salesforce... it seems they can be an IdP, not an SP, no?
Apr
22
comment Should I create one key pair per customer as Service Provider in SAML?
I represent the SP, I don't care how the users authenticate against the IdP. I don't involve client certificates or use them for authentication. They (along with the private key) merely sign the SAML messages. Should I clarify the question a bit more?
Apr
22
comment Should I create one key pair per customer as Service Provider in SAML?
Thanks for your input. I'm just wondering about this because at the Web layer, customers don't get individual SSL certificates. Why is it different in SAML?
Apr
21
asked Should I create one key pair per customer as Service Provider in SAML?
Apr
14
comment What is the purpose of frequently rotating TLS certificates without changing underlying keys?
@ArranSchlosberg Yes, they did it for, e.g., HEARTBLEED. I'm just wondering about this monthly update thing where not necessarily a compromise is involved, only mitigation.
Apr
14
comment What is the purpose of frequently rotating TLS certificates without changing underlying keys?
Do the usual CAs sign new certificates for free? Otherwise this could be an expensive endeavor for smaller companies.
Apr
2
accepted Is sending plain passwords over SSL as part of a password update process bad?
Feb
25
comment Manually adding 's' to 'http'
@Iszi Yeah well, to be honest I didn't read your analogy. An analogy only gets you so far and usually raises more questions than it answers. My comment only refers to the (small) technical part.
Feb
25
comment Manually adding 's' to 'http'
There are other possible reasons for the red strike-through, e.g., wrong server name or expired certificate.
Feb
21
comment Avoid brute-force enumeration of customers in a SaaS application
Two reasons: User databases are distinct for security and legal reasons and logins are not guaranteed to be unique.
Feb
21
comment Avoid brute-force enumeration of customers in a SaaS application
1. I disagree that it is security by obscurity because we'd rely on a (shared) secret. 2. Customers are very weird. I heard of companies that didn't get—say—Volkswagen as a customer because they already had Mercedes (just an arbitrary example). I will propose your solution to management, though. Maybe this is really a solution to a non-existent problem.
Feb
19
asked Avoid brute-force enumeration of customers in a SaaS application
Feb
17
comment SAML 2.0 IdP metadata security
Couldn't someone perform MITM later if the metadata exchange is intercepted from the beginning?
Feb
11
comment What is a good way to authenticate a user to a smart phone?
On Android, face recognition is a convenience feature. You always have to provide an alternative unlocking mechanism.
Dec
22
awarded  Notable Question
Sep
30
comment Does gitolite provide an attack vector for the shellshock vulnerability?
@hamstar What is LC_FB used for? I tried to google it but no luck.