145 reputation
8
bio website
location
age
visits member for 2 years, 8 months
seen Sep 22 at 12:06

Sep
22
answered Secure REST API and Single Page App by using external OAuth 2 Authorization Code
Dec
7
awarded  Popular Question
Oct
30
comment Difference Between OAUTH, OpenID and OPENID Connect in very simple term?
@ThomasPornin: Wouldn't you say that OAuth is about authorization AND authentication? Because authentication is always the base of a successful authorization, isn't it? Although in your example of OAuth (at least in the Authorization Grant Type) authentication takes place on the server of entity B where authorization is done on Server S. Right?
Oct
23
comment What is the purpose of OAuth 2.0 redirect_uri checking?
But the redirection_uri in the Access Token Request (section 4.1.3 in the spec) mentioned by Steven Xu is only checked on the Authorization Server, the access_token is not redirected to this uri. So the code and the redirection_uri is checked before the access_token is returned to the client app... Me too, I can't think of a reason for the additional checking of the redirection_uri...
Sep
11
awarded  Popular Question
Aug
29
awarded  Popular Question
Jul
28
awarded  Popular Question
Oct
10
accepted Dirty and clean interface on DMZ gateways
Oct
8
comment Dirty and clean interface on DMZ gateways
Thanks. But why do I need two different network interfaces for a two-tiered scenario? I could imagine a scenario with only one internal IP on the gateway and a NAT rule on the external firewall which forwards requests originally targeting the external public IP address to the internal IP address on the gateway... And obviously, the internal IP address is known by clients from the intranet.
Oct
8
asked Dirty and clean interface on DMZ gateways
Apr
16
answered Security of Cloud Storage
Mar
6
awarded  Teacher
Mar
3
comment Proof of SIM card possession on iOS devices
Well, even on a jailbroken device an SMS is only delivered to the device if it's in the possession of the correct SIM card. So receiving an SMS that contains a challenge works also on jailbroken iOS devices... As it's not possible to react automatically to an incoming SMS the user has to read the challenge and has to enter it in the corresponding app. It's definitely not user-friendly, but quite secure...
Feb
28
answered Best practice to encrypt data in an Android application
Feb
28
comment Best practice to encrypt data in an Android application
Why is setting up an ssl connection not an option? If you are writing the app, I assume that you are in control of both the app and the server. That would be the easiest option in order to decrypt the transmitted data. You wouldn't even have to store the public key of the server in your code as it is part of the handshake. In Android, SSL is really easy to implement as pure java code can be used. By the way, using SSL the integrity issue is also solved.
Feb
19
comment Proof of SIM card possession on iOS devices
You're right, this would be a way. But I'd prefer a programmatic solution if somehow possible.
Feb
19
asked Proof of SIM card possession on iOS devices
Feb
19
asked Can malware read keychain entries on iOS devices?
Feb
19
comment SMS / voice call interception with a fake base station
By the way, according to the defcon video intercepting SMS and voice calls is only easily possible on GSM. So if you can, choose 3G or higher and you should be safe.
Feb
19
awarded  Scholar