Timeline for Mobile application authentication using UUID
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 4, 2019 at 13:33 | history | edited | user163495 |
edited tags
|
|
| Sep 19, 2018 at 6:23 | comment | added | guest | One token would be shared between all user devices. | |
| S Sep 18, 2018 at 16:09 | history | suggested | xorist | CC BY-SA 4.0 |
rephrased some sentences to improve readability
|
| Sep 18, 2018 at 13:53 | answer | added | Anders | timeline score: 2 | |
| Sep 18, 2018 at 13:53 | comment | added | Matthew |
Are you checking that the value supplied as a token is actually a token? For instance, could someone malicious change it to ' or 1=1 -- and get an SQL injection? The token is user provided data in the comparison step, even if it comes from your application which is running on someone else's device.
|
|
| Sep 18, 2018 at 13:52 | review | Suggested edits | |||
| S Sep 18, 2018 at 16:09 | |||||
| Sep 18, 2018 at 13:48 | comment | added | nbering | I've already expressed the opinion in the past that the UUID specification is not trying to solve security problems. It's trying to solve the problem of collisions on randomly generated values. So for a UUID implementation to be completely unguessable, it would have to sacrifice some of it's ability to avoid collisions. | |
| Sep 18, 2018 at 13:47 | comment | added | AndrolGenhald |
What if I have multiple devices I want to have logged in? Besides that I'll just echo what Mike Ounsworth said, just use SecureRandom directly.
|
|
| Sep 18, 2018 at 13:45 | review | First posts | |||
| Sep 18, 2018 at 13:53 | |||||
| Sep 18, 2018 at 13:45 | comment | added | nbering | Seems like a duplicate of security.stackexchange.com/q/190526/113999 and security.stackexchange.com/q/157270/113999. | |
| Sep 18, 2018 at 13:44 | comment | added | Mike Ounsworth |
That seems like the right general approach. I will be the person who complains about UUID: they are not meant to be used as secrets. Why not just use SecureRandom directly and avoid the hassle of trying to guess whether UUID is random or not?
|
|
| Sep 18, 2018 at 13:40 | history | asked | guest | CC BY-SA 4.0 |