User HTKLee

41 votes

What are the differences between JSON Web Tokens, SAML and OAuth 2?

answered Jun 29, 2016 at 1:30

12 votes

Accepted

Lastpass hack - risks for abuse

answered Jun 16, 2015 at 19:26

11 votes

Are password complexity rules counterproductive?

answered Jul 11, 2018 at 20:59

5 votes

Accepted

Are the sha1 hashes used by common ssh configurations insecure?

answered Apr 22, 2019 at 17:30

5 votes

Why can’t I use query Response Mode with id_token Response Type (“implicit” flow)?

answered Feb 1, 2018 at 3:38

5 votes

Accepted

Oauth2 vs APIKey in a server to server communication

answered Feb 15, 2018 at 4:19

4 votes

Microservice to Microservice Auth

answered May 19, 2016 at 5:56

4 votes

Multiple passwords, same account, different privileges

answered Jun 20, 2016 at 6:15

4 votes

Accepted

Any scenario for using both, OpenID Connect and OAuth 2.0?

answered Jun 21, 2016 at 2:08

3 votes

LastPass's use of client-side Salt

answered Jan 16, 2018 at 16:37

3 votes

Accepted

Odd history of OAuth 2 device flow

answered Jan 16, 2018 at 21:23

3 votes

What is the purpose of JSON Web Token (JWS)'s issued at "iat" field?

answered Aug 15, 2018 at 23:34

2 votes

OAuth2 for first party web-app

answered Dec 30, 2019 at 4:16

2 votes

Accepted

Preventing XSS by filtering data from the server to the client

answered Jan 5, 2020 at 5:23

2 votes

Proper way to combine multiple secrets into one HMAC key?

answered Jan 7, 2020 at 22:29

2 votes

Why CVSS range 8 to 9 is almost inexistent

answered Dec 17, 2020 at 21:43

2 votes

Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication?

answered Jan 16, 2018 at 22:18

2 votes

What are the use-cases for Hashicorp Vault PKI?

answered Jan 16, 2018 at 7:54

2 votes

Using password manager along with a remembered password

answered Feb 9, 2018 at 3:11

2 votes

How to cycle OAuth2 client secrets without downtime

answered Jun 18, 2016 at 7:07

2 votes

How is an authorization server supposed to require client auth for confidential clients?

answered Jun 15, 2016 at 7:08

1 vote

How do SSH keys work?

answered Jun 15, 2016 at 22:10

1 vote

What more can I do to secure my service?

answered Jun 16, 2016 at 20:22

1 vote

Partial decryption using untrusted decryption service

answered Jun 18, 2016 at 4:31

1 vote

Accepted

iPhone 5/6 RAM security

answered Mar 6, 2016 at 5:37

1 vote

What can I do to increase the security of my app based on a shared secret?

answered Apr 22, 2016 at 21:34

1 vote

How are symmetric cryptographic keys stored?

answered Apr 8, 2015 at 22:54

1 vote

OpenID Connect: Why use authorization code flow?

answered Jun 28, 2016 at 1:14

1 vote

Number of bytes in a TLS handshake

answered Feb 1, 2018 at 18:13

1 vote

Accepted

How does the user agent know who is logged in? (Using auth codes)

answered Feb 12, 2018 at 23:01

Stack Exchange Network

53 Answers

What are the differences between JSON Web Tokens, SAML and OAuth 2?

Lastpass hack - risks for abuse

Are password complexity rules counterproductive?

Are the sha1 hashes used by common ssh configurations insecure?

Why can’t I use query Response Mode with id_token Response Type (“implicit” flow)?

Oauth2 vs APIKey in a server to server communication

Microservice to Microservice Auth

Multiple passwords, same account, different privileges

Any scenario for using both, OpenID Connect and OAuth 2.0?

LastPass's use of client-side Salt

Odd history of OAuth 2 device flow

What is the purpose of JSON Web Token (JWS)'s issued at "iat" field?

OAuth2 for first party web-app

Preventing XSS by filtering data from the server to the client

Proper way to combine multiple secrets into one HMAC key?

Why CVSS range 8 to 9 is almost inexistent

Is it safe to use OAuth (Resource Owner Password Credentials Grant) for authentication?

What are the use-cases for Hashicorp Vault PKI?

Using password manager along with a remembered password

How to cycle OAuth2 client secrets without downtime

How is an authorization server supposed to require client auth for confidential clients?

How do SSH keys work?

What more can I do to secure my service?

Partial decryption using untrusted decryption service

iPhone 5/6 RAM security

What can I do to increase the security of my app based on a shared secret?

How are symmetric cryptographic keys stored?

OpenID Connect: Why use authorization code flow?

Number of bytes in a TLS handshake

How does the user agent know who is logged in? (Using auth codes)