Questions tagged [expiration-date]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
24 views

How does PGP web of trust handle certificate expiration?

I have certificate that expires in two years. I'll probably try to participate in key signing party so I get to know what it actually looks like. What happens in two years? When my certificate ...
1
vote
2answers
131 views

What happens when the timestamper's certificate expires?

What happens when the timestampers certificate expires? If the code is now untrusted, can it be re-stamped without re-signing? If not, what good does this timestamp do me if my cert is valid until the ...
4
votes
2answers
170 views

How do short lived certificates increase security?

After reading a blog post about the new Roughtime protocol, I am not convinced of the original premise that shorter certificate lifetimes increase security. The claim is that a shorter time somehow ...
2
votes
0answers
268 views

What is the name of the OpenSSL date format? [closed]

The OpenSSL date format has the month first and the year after the time. Example: Mar 18 10:55:00 2017 GMT See also here: https://www.shellhacks.com/openssl-check-ssl-certificate-expiration-date/ ...
0
votes
3answers
198 views

When should TouchID/Fingerprint log-in expire?

I couldn't find such a standard which mention about TouchID or fingerprint log in expiration date. Suppose I have an application and allow users to log in using the fingerprint. I would like to know ...
0
votes
1answer
2k views

Why is the need to expire OTP?

OTP can be implemented either using Google Authenticator or by sending SMS to the user. The GA code is created using a timestamp and the code expires if it's used after some time. However, in case of ...
1
vote
0answers
64 views

Certificate revocation with reason code removeFromCRL

RFC 5280 says: "The removeFromCRL (8) reasonCode value may only appear in delta CRLs and indicates that a certificate is to be removed from a CRL because either the certificate expired or was removed ...
3
votes
2answers
4k views

JWT access token and refresh token

We have two applications App1 and App2. A user uses a browser to communication withe apps. App1 supports different auth. mechanisms (SSO, usr/pwd, etc.) but App2 doesn't have any access to auth data ...
2
votes
2answers
1k views

How can an expired SSL certificate make the server and/or client vulnerable to MITM attacks? [duplicate]

When I see the warning on my browser about "Invalid Certificate" or "Untrusted Certificate" , I might have doubt about a MITM attack at my network. Should I have the same concern when I see that the ...
2
votes
1answer
54 views

Authorization expiration without reliable clock / time

I've been looking, but I think its impossible to find a pairing solution that has the benefits of authorization expiration and renewal (like x509 cert expiry and OAuth expires_in), but that works ...
0
votes
3answers
115 views

Why is it allowed to change dates to absurd values in OS?

I have always considered this a bad practice, although it's true it's not a big issue because any software that depends for something important on dates is mostly gonna work using a reliable source to ...
0
votes
2answers
68 views

Embedding expiry dates into keys possible?

I have an app which uses an asymmetric key for encrypting/decrypting data between devices. However, these devices should no longer be able to decrypt after a certain period of time. Currently, I'm ...
2
votes
2answers
387 views

Stateless secure token that can expire?

I want to generate a link that will be given to a user. On this link, as a parameter, I will add a token that will be valid only for a few days. So after that time, the server will check the token, ...
56
votes
6answers
18k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...