Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [access-control]

A security mechanism which enforces policy describing which requesters may perform operations on specified objects. There are typically multiple types of operations. Common operations include: read, write, execute, append, create, and delete.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
35 views

Bell-Lapadula model "Execute" permission

In all BLP model descriptions I've seen, the permissions set is defined to be {Read, Write, Append, Execute}. None of the three BLP security properties The Simple Security Property states that a ...
hegash's user avatar
  • 99
1 vote
1 answer
62 views

Does giving a user a Admin / Privileged account plus a standard account violate "Separation of Duties"?

Let's say a user requires admin privileges as part of their role for installation of required tooling. Would allowing them a separate admin account to perform these activities be best practice as ...
Ake33's user avatar
  • 11
0 votes
0 answers
77 views

Why does IPsec use tunnel-mode for an external laptop? Could transport-mode be used? Why can't a gateway control access in transport-mode?

In an IPsec Secure gateway setup, why is tunnel-mode used when an external laptop wants to access an internal service protected by a firewall? Is tunnel-mode necessary or could transport-mode be used ...
Allexj's user avatar
  • 137
0 votes
1 answer
225 views

is access token using SHA256 secure?

I want to create a server where after the user logs the server gives them a randomly generated access token that is hashed using SHA256, that I store in the database a long with an expiration date, I ...
a_duck's user avatar
  • 1
0 votes
0 answers
73 views

compatability of Desfire EV1/2 readers and cards with a Doorking access control system

I am getting the idea that Doorking's ProxPlus cards and reader have a pre-defined encryption key in their reader. As these readers are wiegand devices and the software for the Doorking Access systems ...
steve vogel's user avatar
0 votes
0 answers
167 views

How do hackers hack into private network device? [duplicate]

As a picture show above, how do hackers use PC0 to hack into PC1? They are in different private network. As far as I know, we can use VPN to communicate two different private networks, so do hackers ...
甚麼甚's user avatar
0 votes
0 answers
60 views

Permission model for automated infrastructure provisioning

I am trying to secure automatic infrastructure provisioning but I am having a hard time designing a proper access policy that would not create a single point of failure (I tried and failed about a ...
Michał Dębski's user avatar
1 vote
1 answer
437 views

CVSS3 Scope change question

Let's say I have an e-commerce organization. My organization has two security authorities A and B. The authority A manages access to data related to user orders, and the authority B manages access to ...
mateleco's user avatar
  • 110
0 votes
1 answer
165 views

Is there a problem to store user permissions in the database instead of in a external auth service?

In AWS Cognito we could define a role/permissions as a custom attribute in the user pool, but we could have a User table and a caching database and fetch roles each time the user does a request. Of ...
Vitor Figueredo Marques's user avatar
0 votes
2 answers
1k views

What is a proper way to prevent parameter tampering and to make parameter secure

I'm developing a HTTP web server. I've used HTTPS as the protocol between client and server but I know that HTTPS can't prevent parameter tampering. As we know, we can set parameters in URL, in HTTP ...
Yves's user avatar
  • 361
2 votes
1 answer
260 views

Is this considered Privilege Escalation?

Suppose I have an Admin account and a normal user account. There is some functionality that is only accessible to the admin only, like promoting other users. In this scenario, I captured a request ...
infosec_learner's user avatar
1 vote
0 answers
191 views

Is it a good idea to combine DAC with RBAC in this way?

I am not an infosec professional, but I'm working on a project that requires designing and implementing a permission system for a customer. The system the customer proposes is as follows: Users are ...
Oscar's user avatar
  • 11
3 votes
1 answer
296 views

Oauth: redirect uri validation [duplicate]

As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/ we should validate the redirect url at 3 points: at time of app registration when the auth flow ...
gaurav5430's user avatar
3 votes
2 answers
159 views

Any obvious pitfalls of modeling access control policies using subject, scope, object?

Context A small web application with REST API and postgres as db, that has users, documents and teams. A user can do basic CRUD operations on document. A user is always a part of a team. A team is ...
iovo's user avatar
  • 33
1 vote
0 answers
416 views

Link that allows access to documents without authentication

I am testing an app and I found a link in source code that permit me to access a document without authenticating to the application on which that document is present. The url has a key in the get and ...
moskino11's user avatar
  • 117
1 vote
1 answer
361 views

How do AppArmor and systemd access controls compare?

This may be comparing chalk with cheese, but I'm wondering how these tools compare: pros and cons, similarities and differences, and situations where you would use one vs the other.
Kevin Wheeler's user avatar
3 votes
1 answer
383 views

AMD SEV - attack through the hypervisor console

AMD SEV enables creating a trusted encrypted VM where the memory of the whole VM is encrypted using cryptographic keys and features on the CPU and thus not visible to the cloud provider (in theory if ...
Pavle V's user avatar
  • 31
2 votes
1 answer
321 views

Can a subject in Bell-LaPadula model write to other files with different compartments but same classification?

my question is based on the post made Toaster which never got a reply (Bell-LaPadula Model Compartments). In BLP If a subject has a classification level General and compartment Land (General, {Land}), ...
jefazo92's user avatar
0 votes
0 answers
71 views

What risks are there in using an OAuth2 access_token from an IdP that I do not control to secure an API that I do control?

Imagine I host some API. Its exact function is irrelevant to the question, but it needs to have some sort of authorization put in front of it. I want to call Google's APIs, so users can interact with ...
Richard Ward's user avatar
0 votes
0 answers
65 views

ACL management (file access) & security

I'll start by saying I'm not sure which stack community I'd ask my question, but I'm looking into using ACLs to manage file access on our server because of specific IT security requirements. We mostly ...
MHeydt's user avatar
  • 1
2 votes
1 answer
237 views

Linux access control policies sudoers

I'm learning about linux hardening and I'm creating a sudoers file. My idea is to separate things. There will be a user to see log files, another that can sudo to manage system processes, another for ...
guu1's user avatar
  • 21
-1 votes
1 answer
122 views

how to fully secure web/mobile/desktop application connected the same backend server [closed]

I have a React/Express application, I want to fully secure it. I'm looking for best practices for these features: data encryption/decryption end-to-end communication access control role management ...
Ayoub Benayache's user avatar
0 votes
0 answers
16 views

Application to archive a file with multiple passwords [duplicate]

Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords? For example the password protected archive "example.7z" can be ...
David's user avatar
  • 1
0 votes
2 answers
335 views

can virtualbox be used to access a locked website without being tracked and without getting detected of using a virtual machine?

I need to open a website where access is denied in my country. I would like to know if virtualbox can be used to solve this issue. my concern is if they can detect that I am using a virtual machine. ...
Marwan Maalouf's user avatar
0 votes
0 answers
113 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
themissionmars's user avatar
1 vote
1 answer
195 views

Remote access at the will of my tech support service

My tech support company now has access to my computer 24/7... instead of our old system where I would email them, set an appointment, and then I would grant them permission to access my computer. A ...
lita's user avatar
  • 21
0 votes
1 answer
164 views

RAM as a attack target

What is the simplest or most common method to read a value, for example a text, from the RAM of a personal computer? What access requirements are necessary for this? Is a search in a hex dump always ...
BeloumiX's user avatar
  • 256
0 votes
1 answer
159 views

Github.com token authorisation since 13th August, impractical?

Gihub removed password authentication: remote: Please see https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ for more information. fatal: unable to access 'https://...
run_the_race's user avatar
6 votes
4 answers
14k views

How to prevent spoofing of X-Forwarded-For header?

X-Forwarded-For header can capture the IP of the client and use this IP to implement access control. However, the X-Forwarded-For header can be easily spoofed or manipulated. How to prevent this or is ...
ChallengeMe's user avatar
0 votes
1 answer
210 views

Creating a unique password for each device/unit of the same product

We are currently working on an IoT product & having a hard time coming up with a strategy to create a unique password for each device/unit. I do understand that password based on a function of { ...
Baranikumar Venkatesan's user avatar
3 votes
1 answer
408 views

What is the equivalent of "forgot password" in password-less login applications using FIDO2 / Webauthn or later?

I'm assuming instead of saying "forgot password?" the text would say "lost your key?" or "don't have your device?". But what would the process of secondary access look ...
eternaltyro's user avatar
2 votes
2 answers
307 views

Access Control for REST APIs - OWASP recommendation

OWASP states: Non-public REST services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorisation logic ...
Eduardo Bueno's user avatar
1 vote
1 answer
134 views

Is my website vulnerable if I use Access-Control-Allow-Origin * for a section?

I have a map (openlayers) which is integrated in a website made on wordpress. So, the wordpress has almost nothing to do with the map. The map is only included in an article. The wordpress site is on ...
Andrei's user avatar
  • 13
0 votes
1 answer
3k views

Can my company track my laptop if I've reinstalled the operating system?

I was given a laptop by my company. I reinstalled everything and now I occasionally open Whatsapp web in the background to reply to messages. Most of the times my laptop is connected to the Company's ...
MUHAMMAD QASIM KHAN's user avatar
2 votes
3 answers
226 views

Refreshing access token using access token

Is it safe to refresh your access token using your access token (assuming of course it is still valid)? And, if not, what makes a refresh token that much more special that it is safe to be used as a ...
Bram's user avatar
  • 123
0 votes
1 answer
271 views

Use case where MAC and DAC complement each other

We can implement MAC (Mandatory Access Control) and DAC (Discretionary Access Control) together and they can complement each other. My understanding is when MAC is there it overrides everything. Can ...
Sirisha Chiruvolu's user avatar
1 vote
1 answer
367 views

Prevent a remote privilege escalation when the root/admin password is known

Consider the following Linux system: root account is disabled (passwd -l root, passwd -d root), there is an account 'admin', with sudo rights, there is an account 'webservice', with limited ...
ndou's user avatar
  • 111
9 votes
2 answers
2k views

How is MAC useful?

I know what mandatory access control (MAC) is, but I don't see how it helps. Often it seems to be said that if you have something like SELinux or AppArmor enabled you are magically more secure. And ...
Teipekpohkl's user avatar
3 votes
2 answers
229 views

Encryption as bijective data masking function

Context I'm building data lake from scratch within a small team (3-6 data engineers). I want to mask PII data when copying data from prod to dev/test environments. I'm particularly interested in the ...
VB_'s user avatar
  • 225
3 votes
1 answer
215 views

Should users be allowed to to login with the same email when an email change is requested but not completed?

I've found a very similar question: Should users be allowed to log in with the same password when a password change is requested but not changed?. But the key difference here is that requesting an ...
Mario Ishac's user avatar
76 votes
8 answers
11k views

Why is email often used as the ultimate verification?

In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your ...
Teipekpohkl's user avatar
1 vote
1 answer
891 views

How does Chromium's sandboxing compare to Firejail's?

I am increasingly being requested to join videoconferences through Zoom, which I don't trust to run on my machine. I understand that there are two common ways of sandboxing this software: you can ...
Psychonaut's user avatar
0 votes
2 answers
1k views

It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?

To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes. I noticed that most of the time X ...
Ubaidah's user avatar
  • 1,074
0 votes
3 answers
315 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
David's user avatar
  • 101
3 votes
1 answer
291 views

Encrypting links between registered users and their sensitive data

I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database. Furthermore, if a user has multiple pieces of sensitive data, ...
teppo's user avatar
  • 131
0 votes
1 answer
161 views

How to protect against a user using many different IP addresses and creating many accounts? [closed]

Is it even possible? I have an application that is susceptible of a same person creating many different accounts on different IP addresses. How to fight against this the best? Using 2-step ...
evening's user avatar
  • 461
0 votes
1 answer
2k views

In what cases people know that I see their stories on instagram or mystalk? [closed]

I don't have an instagram account, but I always look to my friends' profiles on instagram or mystalk and see their stories. BTW my google account is always signed in when I check their stories on ...
Christina's user avatar
  • 103
0 votes
1 answer
111 views

Difference between access control systems that can/can't be compromised without valid credentials?

Take the following examples: When I run sshd, it can in theory grant access to anything that the process itself has access to, regardless of provided credentials. For example, I could in theory ...
Kevin P. Barry's user avatar
1 vote
3 answers
2k views

Is SSH server secure from internet access outside private network?

I have a desktop computer in my home network with SSH server running on it. Using another computer in my private and local network (class C IP addresses: e.g., 192.168.0.2, etc) I sometimes use SSH to ...
rebatoma's user avatar
  • 113
2 votes
2 answers
178 views

Is using EXECUTE AS impersonation for user authentication in a web application a good idea?

I wrote a web application that is using AD authentication (Windows) and has its own authorization module (RBAC-like). Back-end is Microsoft SQL Server. A DBA on my team is not happy with us using a ...
NotADba's user avatar
  • 21

1
2 3 4 5
12