Security

A system for approaching security questions

Wednesday, October 17, 2018

Security questions are user hostile and advantage the attacker Why security questions suck They’re based on publicly available information. They’re based on capricious and changing feelings They’re based on murky and easily misremembered factoids They’re based on certain assumptions of the world that are not universally true What to do? Social Engineering A system for security questions System Requirements System #1 - Design Considerations The MUST-NOT Items The MAY Items Some Example System 1 System #2 - Design Considerations Conclusion Security questions are user hostile and advantage the attacker Security questions are a terrible concept and should be abolished. Unfortunately, they won’t be, and even if they will be at some future point, they’re here now and we’re forced to participate. …

Long Lived SSH Keys Considered Harmful

Monday, September 3, 2018

Disclaimer: This advice goes for any credential, including and especially passwords tl;dr: You should, at regular intervals, change out and retire old SSH keys. SSH keys are dangerous An SSH key should be considered a short-lived resource and as such and should be refreshed periodically. Here are a few reasons why: They can be compromised They are highly privileged They can be automatically generated They can easily be replaced on many services Refreshing your SSH keys has the added benefit of following the Let’s Encrypt School of Critical Process Management: …

Arguments Against HTTPS

Monday, September 3, 2018

Disclaimer: I think HTTPS everywhere is a generally good thing, but it isn’t unmitigated. See this earlier post about why HTTPS is good and why you should do it. That being said, there are arguments against it that ought to be taken seriously. Some of these arguments apply systemically, i.e., because of choices made by the browser vendors, such as the decision to mark all non-HTTPS sites as insecure by default. …

What Good Are VPNs?

Tuesday, July 24, 2018

Good at some things, bad at others. At the most basic level, a VPN is an end-to-end service that encrypts network activity on one end and decrypts it at another. Depending on what kind of platform you are on, VPNs can be installed at different and deeper layers of the network stack. That’s all it is. Encrypted data at one end, decrypted data at the other. Anything else is fluff, extras added on top. …

HTTPS Is About Respecting Your Users

Tuesday, July 24, 2018

Respect Your Users As of July 24th, 2018, Google Chrome is visibly marking all non-HTTPS sites as “not secure”. In light of this, it might be prudent to elaborate on what exactly HTTPS is meant to do. A site without HTTPS is vulnerable to Man-In-The-Middle (MITM) attacks, which Troy Hunt shows off convincingly over at https://www.troyhunt.com/heres-why-your-static-website-needs-https/ That site is all about demonstrating through words, video, and actions, what happens when you don’t have HTTPS. What I want to touch on is why, morally speaking, HTTPS is a good thing. …

Towards a Secure and Private Firefox Installation

Thursday, July 5, 2018

With the massive overhaul that was Firefox Quantum (FF57), it’s worth checking out how to make a modern Firefox install secure. Much of modern Firefox’s security comes from the fact that in addition to doing extensive work on the architecture underlying the browser as a whole, they also removed the old extensions system. That has been a double-edged sword, because many beloved extensions relied on the that old architecture, but the Firefox developers have been working closely with the authors of popular extensions to add back in the necessary pieces they require. …

Implement an OAuth 2.0 Server (Part 19)

Monday, June 18, 2018

Welcome to the nineteenth and final part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Pushing to Azure To finish off this project, we’ll be deploying our application to the free tier of Microsoft Azure. We’ll be taking most of our cues from Nate Barbettini’s excellent Little ASP.NET Core Book For the purposes of this tutorial, I assume you already have a Microsoft account and are willing to use it to deploy to the cloud. …

Implement an OAuth 2.0 Server (Part 18)

Monday, June 18, 2018

Welcome to the eighteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Rate Limiting - Attribute Creation We left off last section with rate limits being granted to the to clients and tokens at creation time, but we don’t yet have a way to check those limits when they call our API. To do so, we’ll be making an Attribute that we can use to decorate the controllers or methods that we want to be rate limited. …

Implement an OAuth 2.0 Server (Part 17)

Monday, June 18, 2018

Rate Limiting - Models and Provider Changes There are any number of different ways to implement rate limits - the approach we will follow is outlined like so: All endpoints under /v1/api are limited, no endpoint is free. All endpoints share a limit. Calling /me 1,999 times, then /albums once will rate limit you on the next call. (Assuming a limit of 2,000 for some timeframe.) Renewing a token counts towards the limit - after all, the token endpoint is underneath /api/v1/. Different levels of authorization are granted different rate limits. In descending order of highest rate limits: Authorization Grants Implicit Grants Client Credentials Rate limits are incremented against both a client + user combo, and then again against just the client. This has implications we’ll explore below A given client can be granted a rate limit override. The overall limit of a client can be overridden, and The limits granted to subordinate tokens can be overridden Rate Limits are on a rolling timespan of 1 hour Calls collect for an hour after the initial call, and are purged at the expiration of that hour. Implications of User + Client separate from Client limits In our implementation, a given client will have two rate limits: One for each user that requests a token, with a varying default based on the grant_type, and one for the client itself. The client one will be exponentially higher than the one applied to the users. …

Implement an OAuth 2.0 Server (Part 16)

Monday, June 18, 2018

Welcome to the sixteenth part of a series of posts where we will implement an OAuth 2 Server using AspNet.Security.OpenIdConnectServer. Token Revocation Token revocation is the process of invalidating already issued tokens. Because tokens are serialized with server data taken at a snapshot in time, there is no way for a token to know whether it’s been invalidated, except for when it comes to its expiration date. Further, there’s no given way for the server to know a token has been revoked either - at least, not without a backing datastore. …