Questions tagged [expiration-date]
The expiration-date tag has no usage guidance.
23 questions
68
votes
6
answers
37k
views
How to Securely Implement a "Remember Me" Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
- 893
32
votes
5
answers
6k
views
Why are refresh tokens treated differently than access tokens
If we consider that having a valid refresh token allows you to get a valid access token, then the two can be considered to have the same 'informational value' right?
Then why are they treated ...
- 439
6
votes
3
answers
4k
views
What happens when the timestamper's certificate expires?
What happens when the timestampers certificate expires?
If the code is now untrusted, can it be re-stamped without re-signing?
If not, what good does this timestamp do me if my cert is valid until the ...
5
votes
3
answers
605
views
How do short lived certificates increase security?
After reading a blog post about the new Roughtime protocol, I am not convinced of the original premise that shorter certificate lifetimes increase security. The claim is that a shorter time somehow ...
- 34.7k
4
votes
1
answer
2k
views
Can I change expiration date of a gpg key I've already sent to a key server?
ArchLinux wiki page on GnuPG reads
Once a key has been submitted to a keyserver, it cannot be deleted from the server.
Does that mean that also the expiration date with which I published the key via ...
- 183
3
votes
1
answer
3k
views
How does the SSL/TLS protocol determine if a certificate is expired or not?
I already tried googling but no luck. All search results always tell you how to check cert expiration manually, but that is not my question. Yes I can use OpenSSL for example, but what I am asking is ...
- 139
3
votes
2
answers
3k
views
How can an expired SSL certificate make the server and/or client vulnerable to MITM attacks? [duplicate]
When I see the warning on my browser about "Invalid Certificate" or "Untrusted Certificate" , I might have doubt about a MITM attack at my network. Should I have the same concern when I see that the ...
- 507
3
votes
2
answers
5k
views
JWT access token and refresh token
We have two applications App1 and App2. A user uses a browser to communication withe apps. App1 supports different auth. mechanisms (SSO, usr/pwd, etc.) but App2 doesn't have any access to auth data ...
- 129
3
votes
1
answer
1k
views
PGP expired encryption subkey : renew or replace?
I am in the process of learning PGP (GnuPG more precisely).
I am trying to figure out which is the best strategy for my encryption ([E]) subkey in terms of expiration/revocation/renewal. Could you ...
- 133
3
votes
1
answer
1k
views
Why does Windows consider a certificate valid even after its expiration time?
I downloaded Google's Cloud SDK installer today, and upon checking the certificate to validate it, I noticed something strange: the expiration date of the certificate appears to be December 22nd 2019 -...
- 33
3
votes
0
answers
3k
views
What is the name of the OpenSSL date format? [closed]
The OpenSSL date format has the month first and the year after the time.
Example: Mar 18 10:55:00 2017 GMT
See also here: https://www.shellhacks.com/openssl-check-ssl-certificate-expiration-date/
...
- 131
2
votes
2
answers
404
views
Do registration codes need expiry?
I work on an application where users are sent a unique registration code in the post. They use this, along with other personal information known to the user, to confirm the identity of the user upon ...
- 21
2
votes
1
answer
152
views
Authorization expiration without reliable clock / time
I've been looking, but I think its impossible to find a pairing solution that has the benefits of authorization expiration and renewal (like x509 cert expiry and OAuth expires_in), but that works ...
- 21
2
votes
2
answers
655
views
Stateless secure token that can expire?
I want to generate a link that will be given to a user. On this link, as a parameter, I will add a token that will be valid only for a few days. So after that time, the server will check the token, ...
- 771
1
vote
1
answer
3k
views
Request certificate expiration date in CSR
I want to see how my application will behave in case if the SSL certificate expires.
CSR are signed by CA, so they are not self-signed and the validity period is 2 years. For my test I want to set ...
- 422
1
vote
1
answer
5k
views
Why is the need to expire OTP?
OTP can be implemented either using Google Authenticator or by sending SMS to the user. The GA code is created using a timestamp and the code expires if it's used after some time.
However, in case of ...
- 161
1
vote
0
answers
118
views
How does PGP web of trust handle certificate expiration?
I have certificate that expires in two years. I'll probably try to participate in key signing party so I get to know what it actually looks like.
What happens in two years? When my certificate ...
- 111
1
vote
0
answers
237
views
Certificate revocation with reason code removeFromCRL
RFC 5280 says:
"The removeFromCRL (8) reasonCode value may only appear in delta CRLs and indicates that a certificate is to be removed from a CRL because either the certificate expired or was removed ...
0
votes
3
answers
1k
views
When should TouchID/Fingerprint log-in expire?
I couldn't find such a standard which mention about TouchID or fingerprint log in expiration date.
Suppose I have an application and allow users to log in using the fingerprint. I would like to know ...
- 35
0
votes
3
answers
207
views
Why is it allowed to change dates to absurd values in OS?
I have always considered this a bad practice, although it's true it's not a big issue because any software that depends for something important on dates is mostly gonna work using a reliable source to ...
- 149
0
votes
1
answer
807
views
How to generate an expired key with gpg?
For testing purposes, I need a PGP key for a specific uid that has already expired.
Using gpg --full-generate-key only gives me the following options:
Please specify how long the key should be valid.
...
- 764
0
votes
1
answer
2k
views
Best practice for encrypting data on Mifare
I am currently playing around with Mifare Classic 1k. And everything I have read about it's security is true. So it's not exactly the best thing to use to avoid cloning. But I was wondering if someone ...
- 101
0
votes
2
answers
451
views
Embedding expiry dates into keys possible?
I have an app which uses an asymmetric key for encrypting/decrypting data between devices.
However, these devices should no longer be able to decrypt after a certain period of time.
Currently, I'm ...
- 367