Reputation
290
Top tag
Next privilege 300 Rep.
Create new tags
Badges
2 8
Newest
 Commentator
Impact
~7k people reached

  • 0 posts edited
  • 0 helpful flags
  • 0 votes cast
Oct
30
comment Does OAuth effectively mean allowing an app to do everything as me?
I am learning this working on a custom app talking to JIRA. At the very least, it means you have to be extremely cautious with such apps. Understand that as soon as you authorize them, they can do everything, and for a long time (unless you go through the hassle and manually revoke the token). It means you have to absolutely trust the application's creator (or review its code prior to install) and its environment (e.g. server access). App creators have to understand this as well, before they consider just saving tokens to disk.
Oct
30
comment Does OAuth effectively mean allowing an app to do everything as me?
@Phorce Correct. But if the app is malicious and gets a privileged user to log in, it can do everything impersonating them - right?
Oct
30
asked Does OAuth effectively mean allowing an app to do everything as me?
Oct
30
comment Should we store accesstoken in our database for oauth2?
I have the exact same issue. The problem is, every time they log in, new OAuth session is established. After 20 logins, there will be 20 "loose" sessions open. If you go to a page listing authorized tokens on your service provider's site, it looks like headache. How do you deal with that?
Sep
22
awarded  Commentator
Aug
18
awarded  Notable Question
Sep
24
awarded  Autobiographer
Jul
22
awarded  Popular Question
Apr
27
awarded  Popular Question
Dec
11
awarded  Popular Question
Jun
30
awarded  Yearling
Aug
3
comment Using password hash as session ID?
Right. I wouldn't do it with browser-based client. I'm talking about a rich desktop client which does not really use HTTP. I know the difference between SSL and session management. Mentioned it only to prevent answers talking about channel security.
Jul
2
accepted What to transfer? Password or its hash?
Jul
1
accepted Using password hash as session ID?
Jul
1
comment Using password hash as session ID?
Anyway, the point about gaining permanent access and having more places to secure (not just one request handler) makes much sense.
Jul
1
comment Using password hash as session ID?
@mehaase Good points (both of them). I think my thick client with TLS is invulnerable to XSS. For a determined attacker, capturing one request is not much more difficult than capturing more of them (and that's not a problem with TLS).
Jul
1
awarded  Nice Question
Jun
30
comment Using password hash as session ID?
Right, and my question is: What exactly is insecure in using this specific kind of session key for secure channel? Is it only the fact that it's not temporal?
Jun
30
comment Using password hash as session ID?
Can you explain which assumptions are faulty? I agree they are very similar, but I don't think they have the same answer. Secure authentication over insecure channel is different from session maintenance over secure channel. What I'm trying to find here is whether having this kind of key is secure - the fact that it's static, as well as that it's directly related to password management.
Jun
30
comment Using password hash as session ID?
This is a good point, but... If they are able to install a trojan or keylogger on client, there's little difference between capturing a password on login and capturing the hash (or session ID) later.