Authentication Hub

re: Authentication Hub

Anatoly Lubarsky — Thu, 12 Apr 2007 04:12:32 GMT

Hi Alik

Regarding SOA - currently only WSE (imho) gives complete solution because it implements oasis completely.

The solution mentioned is not complete since it does not protect against replay attacks and http proxy interception and changing message.

re: Authentication Hub

alikl — Thu, 12 Apr 2007 07:02:13 GMT

Anatoly, good points!

The goal of "SOA.." post was not to present complete solution rather show Authentication (context 1) in internet scenario (another narrowing context 2)

Complete solution is too broad statement so use above contexts to narrow.

Re WSE - today i try to stay away from it since WCF replaces it

Re replay attacks - Client certs are one of the strongest authentication mechanisms available

Re proxies and tampering - countermeasure for these would be - input validation.

imagie that i create proxy inside the WSE pipeline, or remoting pipeline like here

http://blogs.microsoft.co.il/blogs/alikl/archive/2006/11/25/App-Architecture-with-Security-in-mind-_2D00_-Video_2C00_-Part-II.aspx

or WCF pipeline like here

http://blogs.msdn.com/alikl/archive/2007/03/04/how-to-hack-wcf-new-technology-old-hacking-tricks.aspx

So no signature would help to counter these but good input validation

the full story is here http://msdn.com/SecurityEngineering

.Net Security How To's

alik levin's — Mon, 30 Apr 2007 15:14:29 GMT

patterns & practices Security How To's Index ASP.NET 2.0 Security Questions and Answers Tamper detection

How I Setup Lab Domain Using VPC 2007

alik levin's — Tue, 29 May 2007 21:04:17 GMT

To quickly set lab environment I use VPC 2007 ( free download ). It really saves me lots of time. For

Security Educational Workshop - Authentication Explained

alik levin's — Thu, 31 May 2007 22:08:24 GMT

I just finished building another security workshop that covers authentication and identity technologies

Web Services Over SSL - Is It Really That Slow Like They Say?

alik levin's — Wed, 01 Aug 2007 17:35:19 GMT

My answer is "no" . I am working on solution where there is no Windows Active Directory Domain so we

Avoid Manipulating Passwords In Memory - It Is Easy To Reveal

alik levin's — Sat, 08 Dec 2007 08:55:44 GMT

Revealing clear text passwords in memory seems to be a trivial task. This post describes how to reveal

Avoid Manipulating Passwords In Memory - It Is Easy To Reveal

Noticias externas — Sat, 08 Dec 2007 09:45:44 GMT

Revealing clear text passwords in memory seems to be a trivial task. This post describes how to reveal