Reputation
2,276
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
2 13 28
Newest
 Quorum
Impact
~144k people reached

Apr
14
comment What are the advantages/disadvantages of attribute-based access control?
It is more expensive to let developers write code, true. However, in the well known RBAC model, creating permissions and assigning permissions to roles is not a developer activity; they are defined externally, just as with ABAC.
Apr
14
comment What are the advantages/disadvantages of attribute-based access control?
None of the standard models for RBAC (RBAC96, NIST-RBAC, Sandhu et al., Role-Graph model) have implicit attributes. There are various non-formalized extension that explore the use of attributes or parameters; some of these models require attribute administration, while others don not and instead rely on implicit or explicit subject or environment attribute and attribute values.
Apr
14
comment What are the advantages/disadvantages of attribute-based access control?
While you bartender story is nice, there is nothing in there that could not be implemented using various other access control models; removing the need for a bartender to see an ID is hardly requires ABAC (it could even be implemented without even implementing an access control model).
Apr
13
comment Which Cryptography algorithm is used in WhatsApp end-to-end security?
Maybe just as import is their implementation of said algorithms though.
Apr
13
awarded  Enthusiast
Apr
12
revised Password Hashing add salt + pepper or is salt enough?
added 2 characters in body
Apr
10
revised Out of band verification using phone; a fallacy?
added direct link to paper
Apr
9
reviewed Approve Charging someone else's cell phone in my car
Apr
9
revised Out of band verification using phone; a fallacy?
deleted 3 characters in body
Apr
9
comment Out of band verification using phone; a fallacy?
@AndréBorie, I know it is :-)
Apr
9
asked Out of band verification using phone; a fallacy?
Apr
6
reviewed Approve Can there still be SQL injection when storing the password as a hash?
Apr
5
comment Is knowing the salt a problem?
The storage issue can be overcome by using rainbow tables.
Apr
4
reviewed Edit How to deal with WPE users
Apr
4
revised How to deal with WPE users
added OP comment as part of the question
Apr
4
reviewed Approve Risks of using a webpage without SSL/TLS for donations
Apr
3
comment What is the most secure database?
related: security.stackexchange.com/questions/13304/…
Apr
3
reviewed Approve How does attacker Brute force facebook account if there is a limit for tries?
Apr
1
reviewed Approve Security Review - password_hash implementation for PHP
Mar
31
reviewed Approve A secret in a URL