Collaborate Disseminate
I use SMS for MFA (yes I know it’s bad, but better than no MFA) in an web application.
On login an OTP is sent to the user via SMS.
This OTP is valid until:
it expires after 10 minutes
it is submitted successfully (can only be used once)
… Continue reading Does an SMS OTP have to be recreated for every message?
Yubico PAM module requires one to specify the id(API client ID) parameter obtained from Yubico API key signup page. For example:
auth sufficient pam_yubico.so id=1234 authfile=/etc/yubikey_mappings urllist=https://api.yubico.com/wsapi/2.0/… Continue reading What is the purpose of Yubico API client ID?
I’ve read the FAQ on this and I do not believe it answers this question:
https://proton.me/support/proton-mail-encryption-explained
Can Protonmail read plain text emails arriving on port 587 (TLS, SMTPS) from non-Protonmail servers before … Continue reading Can Protonmail read non-Protonmail arriving on port 587 (TLS encrypted) right before it encrypts it w/my private key?
My backup of my private key for my gpg key was deleted by mistake when I reinstalled kleopatra software and I need to get my PGP working again!
I need help, how can I recover my private key?
I’m trying to understand why it’s not necessary with MFA in 1Password when signing in to a new device.
This was the case that triggered my curiosity:
I created a 1Password account
I downloaded the Mac application
I installed the Chrome pl… Continue reading Why is 1Password sign-in to new device secure without MFA?
Background:
Setting up an organisational Exchange mail account on a private mobile phone (Android) using Active Sync, one has to accept quite extensive administrative rights for the Exchange mail server, including not only wiping the organ… Continue reading Limit admin rights requested by Exchange Active Sync mail account on mobile phone
I agree that – as always – having two protocols available potentially offers a greater attack surface than either of them. I know Active Sync allows to enforce organisational admin capabilities to wipe mobile devices, which may help for se… Continue reading Genuine security of IMAP vs Exchange Active Sync mail access
Several Windows apps come in both "installer" and "portable" forms, with the latter having the advantage that you can just download and run it from anywhere in the system.
Doesn’t being able to run them from anywhere in… Continue reading Are portable apps vulnerable to binary planting?
Disclaimer + Background
Since self signed certs are not that popular, here’s some context:
I have a 3rd party client/server application that we’re currently using (inside the LAN!) via unencrypted TCP/IP. (The protocol is proprietary, not … Continue reading Is there any point in separating private key gen for a self signed certificate?
According to the "Single sign-on" page on Wikipedia:
A simple version of single sign-on can be achieved over IP networks using cookies but only if the sites share a common DNS parent domain.
This means that if the user has auth… Continue reading Is it possible to use cookie-based single sign-on authentication scheme if sites do not share a common DNS parent domain?