Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

ACL management (file access) & security

I'll start by saying I'm not sure which stack community I'd ask my question, but I'm looking into using ACLs to manage file access on our server because of specific IT security requirements. We mostly ...
user avatar
  • 1
2 votes
1 answer
56 views

Linux access control policies sudoers

I'm learning about linux hardening and I'm creating a sudoers file. My idea is to separate things. There will be a user to see log files, another that can sudo to manage system processes, another for ...
user avatar
  • 21
0 votes
0 answers
14 views

Is the rolling jam attack considered a MITM attack

As far as I understand, the rolling-jam attack involves eavesdropping, signal blocking and replaying. Does that qualify it as an MITM attack? Could one say that the attacker is controlling the traffic?...
user avatar
-1 votes
1 answer
28 views

how to fully secure web/mobile/desktop application connected the same backend server [closed]

I have a React/Express application, I want to fully secure it. I'm looking for best practices for these features: data encryption/decryption end-to-end communication access control role management ...
user avatar
0 votes
0 answers
16 views

Application to archive a file with multiple passwords [duplicate]

Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords? For example the password protected archive "example.7z" can be ...
user avatar
  • 1
0 votes
2 answers
106 views

can virtualbox be used to access a locked website without being tracked and without getting detected of using a virtual machine?

I need to open a website where access is denied in my country. I would like to know if virtualbox can be used to solve this issue. my concern is if they can detect that I am using a virtual machine. ...
user avatar
0 votes
0 answers
68 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
user avatar
1 vote
1 answer
126 views

Remote access at the will of my tech support service

My tech support company now has access to my computer 24/7... instead of our old system where I would email them, set an appointment, and then I would grant them permission to access my computer. A ...
user avatar
  • 21
0 votes
0 answers
93 views

Refresh token rotation or Authorization Code Flow with PKCE

In a new project, we try to clarify how authorization should look like. I've been reading up on this for days, but it's not really clear to me which solution would be the right one to use. Some ...
user avatar
  • 101
0 votes
1 answer
109 views

RAM as a attack target

What is the simplest or most common method to read a value, for example a text, from the RAM of a personal computer? What access requirements are necessary for this? Is a search in a hex dump always ...
user avatar
  • 246
0 votes
1 answer
118 views

Github.com token authorisation since 13th August, impractical?

Gihub removed password authentication: remote: Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information. fatal: unable to access 'https://...
user avatar
3 votes
2 answers
2k views

How to prevent spoofing of X-Forwarded-For header?

X-Forwarded-For header can capture the IP of the client and use this IP to implement access control. However, the X-Forwarded-For header can be easily spoofed or manipulated. How to prevent this or is ...
user avatar
0 votes
1 answer
128 views

Creating a unique password for each device/unit of the same product

We are currently working on an IoT product & having a hard time coming up with a strategy to create a unique password for each device/unit. I do understand that password based on a function of { ...
user avatar
0 votes
1 answer
141 views

What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?

I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
user avatar
2 votes
2 answers
138 views

Access Control for REST APIs - OWASP recommendation

OWASP states: Non-public REST services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorisation logic ...
user avatar
1 vote
1 answer
100 views

Is my website vulnerable if I use Access-Control-Allow-Origin * for a section?

I have a map (openlayers) which is integrated in a website made on wordpress. So, the wordpress has almost nothing to do with the map. The map is only included in an article. The wordpress site is on ...
user avatar
  • 13
0 votes
1 answer
277 views

Can my company track my laptop if I've reinstalled the operating system?

I was given a laptop by my company. I reinstalled everything and now I occasionally open Whatsapp web in the background to reply to messages. Most of the times my laptop is connected to the Company's ...
user avatar
2 votes
3 answers
128 views

Refreshing access token using access token

Is it safe to refresh your access token using your access token (assuming of course it is still valid)? And, if not, what makes a refresh token that much more special that it is safe to be used as a ...
user avatar
  • 123
0 votes
1 answer
97 views

Use case where MAC and DAC complement each other

We can implement MAC (Mandatory Access Control) and DAC (Discretionary Access Control) together and they can complement each other. My understanding is when MAC is there it overrides everything. Can ...
user avatar
1 vote
1 answer
136 views

Prevent a remote privilege escalation when the root/admin password is known

Consider the following Linux system: root account is disabled (passwd -l root, passwd -d root), there is an account 'admin', with sudo rights, there is an account 'webservice', with limited ...
user avatar
  • 111
9 votes
2 answers
2k views

How is MAC useful?

I know what mandatory access control (MAC) is, but I don't see how it helps. Often it seems to be said that if you have something like SELinux or AppArmor enabled you are magically more secure. And ...
user avatar
3 votes
2 answers
168 views

Encryption as bijective data masking function

Context I'm building data lake from scratch within a small team (3-6 data engineers). I want to mask PII data when copying data from prod to dev/test environments. I'm particularly interested in the ...
user avatar
  • 215
0 votes
0 answers
90 views

Bell-LaPadula looking for real code example

I cannot find a single code example of Bell-LaPadula security model. There are pleanty of questions but none got concluded. Does anyone have a clear example in any language that demonstrate it?
user avatar
  • 195
3 votes
1 answer
139 views

Should users be allowed to to login with the same email when an email change is requested but not completed?

I've found a very similar question: Should users be allowed to log in with the same password when a password change is requested but not changed?. But the key difference here is that requesting an ...
user avatar
76 votes
8 answers
11k views

Why is email often used as the ultimate verification?

In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your ...
user avatar
0 votes
1 answer
414 views

How does Chromium's sandboxing compare to Firejail's?

I am increasingly being requested to join videoconferences through Zoom, which I don't trust to run on my machine. I understand that there are two common ways of sandboxing this software: you can ...
user avatar
0 votes
2 answers
134 views

It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?

To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes. I noticed that most of the time X ...
user avatar
  • 1,054
0 votes
3 answers
208 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
user avatar
  • 101
2 votes
1 answer
202 views

Encrypting links between registered users and their sensitive data

I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database. Furthermore, if a user has multiple pieces of sensitive data, ...
user avatar
  • 121
0 votes
1 answer
113 views

How to protect against a user using many different IP addresses and creating many accounts? [closed]

Is it even possible? I have an application that is susceptible of a same person creating many different accounts on different IP addresses. How to fight against this the best? Using 2-step ...
user avatar
  • 471
0 votes
1 answer
2k views

In what cases people know that I see their stories on instagram or mystalk? [closed]

I don't have an instagram account, but I always look to my friends' profiles on instagram or mystalk and see their stories. BTW my google account is always signed in when I check their stories on ...
user avatar
  • 103
0 votes
1 answer
82 views

Difference between access control systems that can/can't be compromised without valid credentials?

Take the following examples: When I run sshd, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory ...
user avatar
0 votes
2 answers
673 views

Is SSH server secure from internet access outside private network?

I have a desktop computer in my home network with SSH server running on it. Using another computer in my private and local network (class C IP addresses: e.g., 192.168.0.2, etc) I sometimes use SSH to ...
user avatar
  • 103
0 votes
1 answer
130 views

EXECUTE AS impersonation

I wrote a web application that is using AD authentication (Windows) and has it's own authorization module (RBAC like). Backend is SQL Server. A DBA on my team is not happy with us using a service ...
user avatar
0 votes
0 answers
107 views

To prevent BadUSB attacks - can't you just block a connection to the specific vulnerable microcontrollers?

Since only a select amount of amount of microcontrollers in the USBs can be reprogrammed, isn't it just possible to block that certain kinds of microcontroller containing devices?
user avatar
1 vote
2 answers
113 views

Terminology question - authentication through encryption

I came across a number of somewhat similar solutions, which are based on the knowledge factor related to a symmetric key in particular: If a party was able to generate correct message authentication ...
user avatar
0 votes
1 answer
233 views

Azure Ad B2C Users access resources in other directory

I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
user avatar
1 vote
1 answer
319 views

Linux security modules (LSM) and reference monitor implementation

as far as my understanding goes, an OS needs to implement some sort of reference monitor, as the entity which grants or denies permissions as an access control decision. Furthermore, I think the Linux ...
user avatar
  • 171
1 vote
1 answer
131 views

Does UHF RFID implement any security at all?

Feel free to correct my below logic. As far as I can tell, HF RFID tags (specifically I've tested MiFare Classic 1kb) have a 48-bit encryption key (default to 0xFFFFFFFFFFFF or something) to protect ...
user avatar
0 votes
1 answer
217 views

Lateral movement while on VPN [closed]

Now that everyone is working from home using VPN, if infected by any malware, is lateral movement possible?
user avatar
  • 1
5 votes
2 answers
670 views

How do EDR prevent you from uninstalling even as local admin?

I have an CrowdStrike EDR and it seems like the only way to disable this on all OS is to provide maintenance-token or ask CrowdStrike to disable the defences so you can uninstall it. I also have a ...
user avatar
1 vote
1 answer
148 views

How to implement MySQL query fo RBAC authorization with fine grained business restrictions in role?

When implementing an authorization system like RBAC/DAC, or XACML, or the AWS IAM authorization model, I see that I can't totally decouple business logic from authorization when there are fine-grained ...
user avatar
0 votes
0 answers
96 views

Devs running IDE's remotely...risks and how to remediate

I have a few developers who - well, let's just say I don't have much faith in their operational security. Time was, in the pre-COVID world, it was well understood that they didn't run IDEs directly ...
user avatar
1 vote
1 answer
155 views

How can we limit access to a single computer?

We would like to limit access to our web servers (and eventually other services on the computer) to individuals that have been authorized access. Of course we don't trust passwords so we think ...
user avatar
0 votes
0 answers
195 views

Random URLs to hide assets [duplicate]

Say I own a domain name www.example.com and I'd like to host some resources on it, but being reasonably hidden from the public. Since a 256 bits has a sufficiently large entropy to prevent an ...
user avatar
3 votes
1 answer
334 views

Risk around "Allow log on locally" for Domain Service Accounts

My organisation mandated that Windows Domain Service accounts internally should not have the "Allow log on locally" permission, and essentially be non-interactive. What exactly is the potential risk ...
user avatar
1 vote
1 answer
121 views

Access-Control-Allow-Origin and security behind it [duplicate]

I have some troubles to understand how the header "Access-Control-Allow-Origin" can really be secure. Let me explain what I have in mind: Let's say I have an API on api.contoso.com setting this ...
user avatar
  • 113
-1 votes
1 answer
85 views

Automatically reconfigure router when it is reset

Is it possible to automatically reconfigure a router when the router is reset? My 13-year old son is resetting the router to bypass time controls (set to go off at midnight). I can configure the ...
user avatar
2 votes
1 answer
128 views

Can linux abstract sockets using a psk as name be found by another user?

If an abstract unix socket is named "\0some random secret", can it be guessed or retrieved somehow from the abstract socket namespace beyond using brute force? Are there more security related ...
user avatar
  • 163
2 votes
1 answer
11k views

"X-Original-URL" and "X-Rewrite-URL" Related Vulnerabilities

I am going through the Burpsuite Academy Training on Access Control and I came across a section I still don't fully understand. In their reading, they explain: Some application frameworks support ...
user avatar

1
2 3 4 5
12