150 reputation
5
bio website titanous.com
location
age
visits member for 1 year, 8 months
seen Nov 18 at 5:10

Developer, security researcher.


Sep
24
awarded  Autobiographer
Mar
18
comment How to support secure creation of a user account over an external API via a queued job?
Does the original password really need to be sent to the third-party API? Why?
Mar
16
comment How to support secure creation of a user account over an external API via a queued job?
The problem with the scheme you originally proposed is that was unsalted, so it's vulnerable to rainbow table attacks. You want to use a key derivation algorithm to slow down brute force attacks (GPUs can run hundreds of millions to billions of SHA-1 hashes per second). The most secure solution is to generate an entirely new random password for the third-party API. Odds are that there is a database in play somewhere, so there's no real complexity to this approach.
Mar
15
awarded  Critic
Mar
15
comment How to support secure creation of a user account over an external API via a queued job?
It's not a good idea to make up new password hashing systems. Use something that's designed for the task and includes salting. bcrypt, scrypt, and PBKDF2 are your best options here. Also, passing a hash of a user's password to a third-party API is a very bad idea.
Mar
14
comment CSRF with OAuth or Bearer Authorization headers
No spec that I know of states this explicitly, but OAuth 2.0 relies on this assumption, and it is used extensively.
Mar
13
awarded  Teacher
Mar
13
awarded  Supporter
Mar
13
answered CSRF with OAuth or Bearer Authorization headers
Mar
13
answered Symmetric key management
Mar
13
awarded  Editor
Mar
13
revised How to support secure creation of a user account over an external API via a queued job?
clarify
Mar
13
answered How to support secure creation of a user account over an external API via a queued job?