I am currently investigating the idea of implementing FIDO2 (WebAuthN) support in native iOS using Swift. I understand that there is no FIDO2 support in native iOS, and only available through Safari native app, but Safari is not an option …
According to RFC 6749 the strings [scopes] are defined by the authorization server.
However isn’t it really the resource server who defines the scopes? I mean scopes vary from resource server to resource server, no? Even if they are regist…
It seems that the options of volatility have changed. How can I extract the memory of a process with volatility 3?
The "old way" does not seem to work:
If desired, the plugin can be used to dump contents of process memory.
vol.p…
I can’t find a definite answer on accessing cockpit from outside machines securely. Just allowing it through the firewall like that doesn’t seem safe. It only uses basic user and password authentication. I think cockpit uses fail2ban to pr…
Give that OrientDB exposes a REST HTTP API, and that it seems to have quite a few security features, what are the (especially security) implications of querying OrientDB directly from a front end web application, without writing and using …
Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get a broader view. This is really a res…
I’d like to understand OAuth 2.0 in more detail and especially the authorization code flow. This might be nit-picking but according to RFC6749 the client initiates the flow.
(A) The client initiates the flow by directing the resource owne…
What difference we can observe when connecting using the certificate generated using the RADIUS and the credentials that we define in RADIUS like username & password.
Today I opened OneDrive by accident, since I do not use it. To my surprise, inside there were unknown folders, in foreign (to me) languages. Namely, "document" and "photo" folders in Korean and a shortcut in French with…
As far as I can tell, scheduled tasks may only be created by those in the Administrators group by default. Does that mean that persistence can’t be achieved via this method without gaining elevated privileges?
