Skip to main content
Geir Emblemsvag's user avatar
Geir Emblemsvag's user avatar
Geir Emblemsvag's user avatar
Geir Emblemsvag
  • Member for 8 years, 9 months
  • Last seen this week
55 votes

Should 2FA be enabled on service accounts?

11 votes

How to do role-based authorization with OAuth2 / OpenID Connect?

9 votes
Accepted

Why does OpenID Connect ("OIDC") use a `nonce` claim instead of the `jti` registered claim

7 votes

Why are developers using embedded user agents for 3rd party auth? What are the alternatives?

6 votes

Asymmetric encryption and signature performed by hand

4 votes
Accepted

Is my password compromised?

4 votes

Are downloads from http connections safe?

4 votes

Authorization Header in dev tools

3 votes

How to ensure JWT security in authentication?

3 votes
Accepted

What are the security risks to displaying an image loaded over http in a page loaded over https?

3 votes
Accepted

Why " Simple Integrity Property" axiom of Biba model protects data integrity?

3 votes

JWT or public-private keys for service to service API calls

3 votes

Is there a risk that file shredders and free space wipers steal our confidential data?

2 votes

CORS clarification

2 votes

Id token contains sensitive information sent by the GET method

2 votes
Accepted

App hosted Oauth login pages: what stops forgery?

2 votes

Could a bad actor get hold of your credential sent via https if you are connect to their fake network?

1 vote
Accepted

What does Frank Abagnale mean by "Level 4 security" in his talk at Google?

1 vote
Accepted

SQL databases password profiling: Same password for all DBs (while it is different from root) - A meaningless step?

1 vote
Accepted

Store user credentials vs store refresh token

1 vote

Is using haveibeenpwned to validate password strength rational?

1 vote
Accepted

Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?

1 vote
Accepted

Logout functionality with JWT Session tokens

1 vote

Prevent CSRF on public website with no login

1 vote
Accepted

oAuth2 scopes and filter conditions in url

1 vote

How does the authorization work after authentication using OpenID Connect

1 vote

Searching encrypted text with encrypted queries

1 vote

OAuth2 JWT Signing with OAuth2 Application Secret Key

1 vote

Can users read client SSL certificates from a react native mobile apps APK?

0 votes

How to get started?