meta user
network profile
| bio | website | myhometownlink.com |
|---|---|---|
| location | Boston, MA | |
| age | 22 | |
| visits | member for | 1 year, 2 months |
| seen | Apr 7 '12 at 23:42 | |
| stats | profile views | 6 |
|
Mar 30 |
accepted | What are the potential vulnerabilities in a SAML-based SSO approach? |
|
Mar 30 |
comment |
What are the potential vulnerabilities in a SAML-based SSO approach? Perfect, thanks for the detailed response Mark. |
|
Mar 30 |
awarded | Scholar |
|
Mar 30 |
accepted | Is DIGEST-MD5 secure if done over HTTPS? |
|
Mar 30 |
comment |
Is DIGEST-MD5 secure if done over HTTPS? Great, thanks! Excellent response. |
|
Mar 29 |
comment |
Is DIGEST-MD5 secure if done over HTTPS? Haha :) Thanks for responding at least! |
|
Mar 28 |
comment |
Is DIGEST-MD5 secure if done over HTTPS? "MD5" makes me look out too because of the well-known collision attacks, but DIGEST-MD5 hasn't been shown to have any issues and is a SASL / Jabber standard (for instance, Facebook uses it as a fallback for their chat authentication). So in this case, SHA-1/2 don't offer any advantages because DIGEST-MD5 is fine, and they're not supported on the 3rd party we're authenticating against. |
|
Mar 28 |
asked | Is DIGEST-MD5 secure if done over HTTPS? |
|
Mar 28 |
revised |
What are the potential vulnerabilities in a SAML-based SSO approach? edited tags |
|
Mar 28 |
asked | What are the potential vulnerabilities in a SAML-based SSO approach? |
|
Mar 13 |
awarded | Supporter |
|
Mar 13 |
comment |
What are all of the issues with storing a cleartext password? Also, I totally agree about the salt. That way an attacker would need to gain access to the code, salt, and db in order to obtain a plaintext password (which, being random in the first place, is not highly valuable anyways in comparison to the rest of the db). |
|
Mar 13 |
comment |
What are all of the issues with storing a cleartext password? Great, thanks. If we use this method, we'll be sure to keep the randomized passwords away from the user to avoid that issue. |
|
Mar 13 |
comment |
What are all of the issues with storing a cleartext password? Cool, thanks for the help! On the off chance we decide to implement our own Jabber server, I think I'm still a little confused about your method but it sounds interesting. After the application has authenticated itself, what is to prevent someone from sending a false identity assertion and logging in as someone else on the system? |
|
Mar 13 |
comment |
What are all of the issues with storing a cleartext password? This is a good point, thanks for bringing that up. |
|
Mar 13 |
awarded | Student |
|
Mar 13 |
asked | What are all of the issues with storing a cleartext password? |
