Collaborate Disseminate
I’m working on a specific security design. When reading it, it looks like some form of OATH but I’m not sure which kind.
The scheme is as follows:
The client authenticates through a web-portal (authorization server) with u… Continue reading How is this token-authentication scheme called?
I have a scheme for a cookie with high-level confidentiality of information. The information to be hidden from the client is the expiration time of the cookie. I am wondering what insecurities i am opening myself up to with t… Continue reading Is this a valid secure cookie scheme?
For an IoT project I’ve defined a simple security schema. Does this already exsist and if so, how is it called?
Definition:
There is one root key.
With every key, a child key can be generated. The creation key becom… Continue reading Does this authentication scheme exist?
I have to write a simple concept wordlist for my class. We are supposed to generate a list alternating between Upper and lower case letters so HoWdY etc. for 10 letters. How would I go about doing this on a linux system?
Rate my authentication scheme? (This feels simple enough to be a duplicate, but it’s really hard to search for these types of questions. Sorry if it is a duplicate.)
When a password is set, it’s immediately hashed with a random salt S1 and stored as H1.
When a user tries to authenticate, they are sent S1 and a random value S2. They then hash their password with S1 to get H1, then hash that with S2 to get H2. H2 is then sent to the server.
The server simply computes H2 the same way, then compares the values. The server then generates a random 64-bit value C and sends it to the user.
All further communications with the server contain C as an authentication token.
The point here is to ensure that the password is never sent in cleartext; the communication channel between the user and server is assumed to be “reasonably” secure, in that this scheme is for an extremely low-value target; the user’s most common passwords are likely to be the most valuable information present.
The protocol should defend against:
EDITS
1337Kid__1 hijacking OtherPlayer‘s account, or an attacker intercepting passwords.
OpenIOC.org has several schemas defining Indicators of Compromise.
The Schema is defined here:
http://schemas.mandiant.com/2010/ioc/ioc.xsd
While under IndicatorItemContext/search says it is xs:string, the actual list of search terms is… Continue reading Where can I find a list of Indicators of Compromise (IOC) conditions?
I’ve asked a few questions relating to schemes for various security-related functions, and posited schemes to accomplish those goals. In the responses, I see a conflict between two fundamental principles of IT security; “defense in depth” … Continue reading Defense in depth vs low complexity – Balancing point?
Why shouldn’t we create our own security schemes?
I see a lot of questions around here about custom crypto and custom security mechanisms, especially around password hashing.
With that in mind, I’m looking for a canonical a… Continue reading Why shouldn’t we roll our own?