150 reputation
4
bio website myhometownlink.com
location Boston, MA
age 24
visits member for 2 years, 6 months
seen Apr 7 '12 at 23:42

May
4
awarded  Popular Question
Mar
30
accepted What are the potential vulnerabilities in a SAML-based SSO approach?
Mar
30
comment What are the potential vulnerabilities in a SAML-based SSO approach?
Perfect, thanks for the detailed response Mark.
Mar
30
awarded  Scholar
Mar
30
accepted Is DIGEST-MD5 secure if done over HTTPS?
Mar
30
comment Is DIGEST-MD5 secure if done over HTTPS?
Great, thanks! Excellent response.
Mar
29
comment Is DIGEST-MD5 secure if done over HTTPS?
Haha :) Thanks for responding at least!
Mar
28
comment Is DIGEST-MD5 secure if done over HTTPS?
"MD5" makes me look out too because of the well-known collision attacks, but DIGEST-MD5 hasn't been shown to have any issues and is a SASL / Jabber standard (for instance, Facebook uses it as a fallback for their chat authentication). So in this case, SHA-1/2 don't offer any advantages because DIGEST-MD5 is fine, and they're not supported on the 3rd party we're authenticating against.
Mar
28
asked Is DIGEST-MD5 secure if done over HTTPS?
Mar
28
revised What are the potential vulnerabilities in a SAML-based SSO approach?
edited tags
Mar
28
asked What are the potential vulnerabilities in a SAML-based SSO approach?
Mar
13
awarded  Supporter
Mar
13
comment What are all of the issues with storing a cleartext password?
Also, I totally agree about the salt. That way an attacker would need to gain access to the code, salt, and db in order to obtain a plaintext password (which, being random in the first place, is not highly valuable anyways in comparison to the rest of the db).
Mar
13
comment What are all of the issues with storing a cleartext password?
Great, thanks. If we use this method, we'll be sure to keep the randomized passwords away from the user to avoid that issue.
Mar
13
comment What are all of the issues with storing a cleartext password?
Cool, thanks for the help! On the off chance we decide to implement our own Jabber server, I think I'm still a little confused about your method but it sounds interesting. After the application has authenticated itself, what is to prevent someone from sending a false identity assertion and logging in as someone else on the system?
Mar
13
comment What are all of the issues with storing a cleartext password?
This is a good point, thanks for bringing that up.
Mar
13
awarded  Student
Mar
13
asked What are all of the issues with storing a cleartext password?