Reputation
2,286
Top tag
Next privilege 2,500 Rep.
Create tag synonyms
Badges
2 13 29
Newest
 Custodian
Impact
~145k people reached

1d
comment Practical Attacks on Mifare Classic Chips
If I'm not mistaken, the Mifare Classic Chip is used in the Dutch national public transport chip card (called ov-chipkaart). The security chip card was completely broken some years back. Searching for ov-chipkaart may lead you to more information.
May
1
comment Using external OAauth Authentication Service, how to manage the users's relations
Maybe also read: Aaron Parecki's OAuth 2 Simplified
May
1
comment Using external OAauth Authentication Service, how to manage the users's relations
Sorry, but I'm not following. An API is an means of communicating with a service. If you build a service and build an API for it, you can have clients communicate with the service through your API. You store data in your database and request access to this data by making a request to the server, using on of the API methods available.
May
1
comment Using external OAauth Authentication Service, how to manage the users's relations
I'm not sure what you mean by 'save the user in the API'?
Apr
30
comment Can governments intercept end-to-end encrypted Whatsapp communication through lawful interception?
Linked by Rоry McCune in chat: whatsapp.com/security/WhatsApp-Security-Whitepaper.pdf
Apr
28
comment PHP null byte exploit through cookie
@tim, Hmm, no. I don't think it would still allow for uri in that case. File system traversal is indeed the best you could do in this case I think.
Apr
28
comment PHP null byte exploit through cookie
Except if "URL include wrappers" are enabled in PHP, in which case you can specify the file to be included using a URL.
Apr
24
comment How long will it take to break a salted password?
Let's not forget that the amount of password that can be computed per second depends on the hashing algorithm used. When using a fast hashing algorithm, it will be easy to crack. As an example, 350 billion guesses per second can be made against md5.
Apr
24
comment Is it a good idea to let a database do a password check?
related: security.stackexchange.com/questions/74068/…
Apr
24
comment Is it a good idea to let a database do a password check?
Data you send to the database commonly can show up in log files: dev.mysql.com/doc/refman/5.5/en/… (and this is not a mysql only issue).
Apr
18
comment SSL certificate and price difference
You pay extra for the 'brand name' and possibly the presumed associated 'better security'.
Apr
14
comment What are the advantages/disadvantages of attribute-based access control?
Also, while ABAC is solving some of the issue in RBAC (most notably the 'role explosion' issue), it also introduces new ones. To try and eliminate the new issues introduced with ABAC (most notably the 'attribute explosion' issue and, maybe more importantly, the lack of audibility), there is a NIST initiative, by Kuhn et al, to unify and standardize various RBAC extensions by integrating roles with attributes, thereby combining the benefits of RBAC and ABAC to synergize the advantages of each. In short: ABAC is not the silver bullet it is sometimes suggested to be.
Apr
14
comment What are the advantages/disadvantages of attribute-based access control?
It is more expensive to let developers write code, true. However, in the well known RBAC model, creating permissions and assigning permissions to roles is not a developer activity; they are defined externally, just as with ABAC.
Apr
14
comment What are the advantages/disadvantages of attribute-based access control?
None of the standard models for RBAC (RBAC96, NIST-RBAC, Sandhu et al., Role-Graph model) have implicit attributes. There are various non-formalized extension that explore the use of attributes or parameters; some of these models require attribute administration, while others don not and instead rely on implicit or explicit subject or environment attribute and attribute values.
Apr
14
comment What are the advantages/disadvantages of attribute-based access control?
While you bartender story is nice, there is nothing in there that could not be implemented using various other access control models; removing the need for a bartender to see an ID is hardly requires ABAC (it could even be implemented without even implementing an access control model).
Apr
13
comment Which Cryptography algorithm is used in WhatsApp end-to-end security?
Maybe just as import is their implementation of said algorithms though.
Apr
9
comment Out of band verification using phone; a fallacy?
@AndréBorie, I know it is :-)
Apr
5
comment Is knowing the salt a problem?
The storage issue can be overcome by using rainbow tables.
Apr
3
comment What is the most secure database?
related: security.stackexchange.com/questions/13304/…
Mar
25
comment How long will it take to break a salted password?
it might also be intersting to note that in the real world, attackers can test billions of passwords per second.