HTKLee's user avatar
HTKLee's user avatar
HTKLee's user avatar
HTKLee
  • Member for 8 years, 11 months
  • Last seen this week
  • United States
41 votes

What are the differences between JSON Web Tokens, SAML and OAuth 2?

12 votes
Accepted

Lastpass hack - risks for abuse

11 votes

Are password complexity rules counterproductive?

5 votes
Accepted

Are the sha1 hashes used by common ssh configurations insecure?

5 votes

Why can’t I use query Response Mode with id_token Response Type (“implicit” flow)?

5 votes
Accepted

Oauth2 vs APIKey in a server to server communication

4 votes

Microservice to Microservice Auth

4 votes

Multiple passwords, same account, different privileges

4 votes
Accepted

Any scenario for using both, OpenID Connect and OAuth 2.0?

3 votes

LastPass's use of client-side Salt

3 votes
Accepted

Odd history of OAuth 2 device flow

3 votes

What is the purpose of JSON Web Token (JWS)'s issued at "iat" field?

3 votes

Proper way to combine multiple secrets into one HMAC key?

2 votes

Why CVSS range 8 to 9 is almost inexistent

2 votes

OAuth2 for first party web-app

2 votes
Accepted

Preventing XSS by filtering data from the server to the client

2 votes

Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication?

2 votes

What are the use-cases for Hashicorp Vault PKI?

2 votes

Using password manager along with a remembered password

2 votes

How to cycle OAuth2 client secrets without downtime

2 votes

How is an authorization server supposed to require client auth for confidential clients?

1 vote

How do SSH keys work?

1 vote

What more can I do to secure my service?

1 vote

Partial decryption using untrusted decryption service

1 vote
Accepted

iPhone 5/6 RAM security

1 vote

What can I do to increase the security of my app based on a shared secret?

1 vote

How are symmetric cryptographic keys stored?

1 vote

OpenID Connect: Why use authorization code flow?

1 vote

Number of bytes in a TLS handshake

1 vote
Accepted

How does the user agent know who is logged in? (Using auth codes)