Timeline for Are there vunerabilities with this authentication mechanism?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 5, 2012 at 18:04 | comment | added | curiousguy | @James "I would obviously need to implement some form of "request" token which would be mapped to a particular user for X amount of time." You remove the username from the exchange, but you need to introduce some "pseudonym" (or temporary ID if you prefer) to replace it. So, you would have to define another protocol to map this temporary ID to a username. The security properties of the whole system would presumably be very similar. But with a more complicated (state-full) protocol, potentially more difficult to analyse, with more occasion to miss a security issue, etc. | |
| Jul 5, 2012 at 17:51 | comment | added | chao-mu | @James removing the username would be like taking a cup full of water out of the ocean. Even if somehow the username could be removed, the attacker probably can figure it out through other means (as you said it was publicly available). Your question has been fully answered with plenty of examples: there are vulnerabilities in your authentication mechanism. | |
| Jul 5, 2012 at 17:40 | comment | added | James | @curiousguy I understand if the username isn't sent then the server wouldn't be able to verify it (in the context of the proposed protocol). I would obviously need to implement some form of "request" token which would be mapped to a particular user for X amount of time. Just asking out of curiosity if the username wasn't there, would it make the protocol any less/more secure. | |
| Jul 5, 2012 at 16:42 | comment | added | curiousguy | @James "if the username wasn't part of the request would it make it any less vurnerable?" How would the server check the password, not knowing the username? | |
| Jul 5, 2012 at 14:19 | comment | added | chao-mu | I think further discussion may be better had in its own thread. "Doable" can mean a lot of things. You certainly will not be saving time/effort/tears trying to write it yourself. | |
| Jul 5, 2012 at 13:43 | comment | added | James | The example I took this from is stackoverflow.com/questions/9386930/…. I was thinking I could possibly get away without using the who API key end of things (as I am not publically opening the API up to developers). Is it possible to implement a token-based system which is secure without having to implement something like oAuth....that article seems to suggest it's doable? | |
| Jul 5, 2012 at 13:38 | comment | added | chao-mu | The password could still be brute forced, since I am describing an offline attack. | |
| Jul 5, 2012 at 8:19 | comment | added | James | Yeah I see where your coming from now, if the username wasn't part of the request would it make it any less vurnerable? | |
| Jul 5, 2012 at 0:13 | history | answered | chao-mu | CC BY-SA 3.0 |