The DMZ

Iszi

8:00 PM

Feel free to stop me if I'm wrong.

AviD

@Iszi Stop. You're wrong.

Iszi

Authentication, in its most basic definition, is the act of proving that you are who you say you are.

Simon

@AviD Refer to the pinned post.

AviD

@Simon just trying to live up to your expectations.

Simon

@AviD Daddy?

Iszi

8:01 PM

Once that is validated, the system then checks to see if the person you say you are is permitted to do the action you're attempting to do in the context which you are attempting to do it.

AviD

@Simon lol

@Iszi that is authorization, which is completely seperate, sometimes even orthogonal, to authentication. in fact someimtes it is not even connected.

Iszi

@AviD That's kind of where I was going with this.

AviD

@Iszi this much is true, but you're missing the implicit definition of identity.

though I really came in very much in the middle - I have NO idea what you're talking about.

not much different from usual, then...

Iszi

@AviD In @ScottPack's scenario, physical location isn't actually being used as an authentication factor - it's an authorization factor.

AviD

@Iszi you mean, part of the context in context-based authorization?

Iszi

8:03 PM

@AviD Precisely.

AviD

that's good - it's usually the case, but not explicitly. usually it is misused and mistreated, as if it is part of the authentication / identity.

which is rarely the case.

@Iszi so, is that good or bad?

Iszi

So, given that one location is readily available to more than one person - and therefore cannot be used to uniquely identify that person - physical location is not usable as an authentication factor under any case.

AviD

Or do I need to read 638 messages in the transcript...

@Iszi Exactly. Almost.

Iszi

@AviD Ok, what's the "Almost"?

AviD

There are certain DoD type scenarios where it IS authentication. Also there are easily plenty of scenarios where it is part of the identity, not the authentication.

Iszi

8:06 PM

@AviD No, I think you're more or less caught up with the conversation as much as you need to be. Might want to from here down to your return though.

@AviD 'splain

AviD

Btw regarding "location" - are we talking geographic location, i.e. gps points, or network location, i.e. IP, or subnet, or... Or location == computer...

Iszi

@AviD Geographic pretty well describes it.

AviD

@Iszi Okay... Think about certain computers which are physically locked down, deep within the bowels of TLA organizations. Access to them pretty much proves by proxy that you are who you say you are.

Or think of the missile control systems on a submarine. You name is not your identity, your use of the computer is.

Iszi

@AviD But, it doesn't. It only proves that you are one among a group of people who are permitted to be in that location.

AviD

though here I'm more talking about network location, or computer... not geographic.

@Iszi ah, see - that takes us back to my earlier point: you did not define "identity".

pop quiz: what is the most common, and simplest, form of identity on the internet today?

Iszi

8:10 PM

@AviD Ok, clarify what you mean by "define identity"?

@AviD IP

AviD

@Iszi both wrong. Want to guess again?

Iszi

@AviD Meh. I give up.

AviD

"Yes I am over 18, now show me porn."

In this case, identity consists only of that one aspect - that you are amongst that elite group of the population who are legally entitled to see boobies on the internet.

Iszi

@AviD Ok. I think I see where you're going with that.

AviD

@Iszi now take that back to "location".

I may have given a poor example - I was not talking about geographic location, so that might have thrown a wrench in. But my point still stands.

Iszi

8:13 PM

So, if [set of people allowed physical access to a location] == [set of people allowed access to a system in that location], then location is an acceptable authentication factor for that system?

AviD

can a group of people be a set?

Iszi

@AviD Are you serious, or just messing with semantics now?

AviD

arent there some mathematical rules that humans dont abide by?

@Iszi hehe, semantics of course :-)

see the pin... ;-)

@Iszi that seems a bit... soft.

but it is possible to conceive of such a situation, yes.

Lucas Kauffman

If anyone else thinks my answer is bad I'll remove it

0

Q: Why can't a AES256-encrypted file be decrypted on machine other than the one it was encrypted?

I encrypted a file on my mac using openssl openssl aes-256-cbc -a -salt -in one.jpg -out two.jpg now if I try to decrypt it like that: openssl aes-256-cbc -a -d -salt -in two.jpg -out one.jpg on my original machine, it works fine. But if I perform the same operation on another machine, it d...

AviD

but the strength of that authentication is based on the strength of those assumptions.

Iszi

8:16 PM

But if [set of people allowed physical access to a location] > [set of people allowed access to a system in that location], then location is not acceptable as an authentication factor for that system?

AviD

makes sense.

of course, it might not be a sufficient factor. and the assumptions are rarely applicable.

thats why I said it is often treated as authN, even though it should be authZ.

Iszi

Okay, now here is the wrench: If the requirement is to "uniquely identify and authenticate" your users, can physical location be used as an authentication factor? I'm hearing... no.

AviD

@Iszi most probably.

.... unless you mean, uniquely identify users by location at a given point in time.

in which case its probably identity, not authentication.

Iszi

Authentication is just proof of identity though, is it not?

AviD

see, people assume that identity is a simple, straightforward flow, you either are or you're not. But actually, from a non-linear, non-subjective viewpoint, identity is more like a big ball of .... wibbly wobbly identity whimey.... stuff.

3

ha!

@Iszi yes, for a given definition of identity.

cmoooon, then - no dr.who fans in the room? I thought that was fanatastic!

Iszi

8:22 PM

@AviD So, if the requirement is to have unique I&A per user then any factor which can readily be assumed to possibly authenticate multiple people (e.g.: location in three dimensions only, or location to within a margin of error larger than the human body) is not an acceptable authentication factor.

AviD

(had to fix it up a bit... )

Xander

@AviD Yeah, that was a pretty awesome description of identity. It's a pretty perfect analogy.

AviD

@Xander well, my point is that identity/authentication is usually seen as a binary you are / you ain't mechanism, when its a lot more iffy than that.

Lucas Kauffman

I need opinions people! Good or bad :(?

AviD

@LucasKauffman Bad. What?

Xander

8:24 PM

@AviD Yup, I absolutely agree.

Lucas Kauffman

@AviD my answer here security.stackexchange.com/questions/38013/…

if it's bad I'll remove it

AviD

@Iszi unique - in what scope? globally? universally? point in time, forevermore?

but yeah, other than that, I think it's a truism.

Xander

@LucasKauffman Ehh...It's kind of a "It works on my machine." answer. It would be more appropriate, in my mind, to explain why it should work, and what could cause it to fail.

Iszi

@AviD Spiffy. I think we're on the same page.

Lucas Kauffman

@Xander that's what I suggest that the file might be corrupt

Xander

8:26 PM

@LucasKauffman Yup, it'd be nice if you expanded a little. I don't think you should delete it.

Lucas Kauffman

alright

willl do rhr

AviD

@Iszi and, if you assume that a certain factor CAN only apply to a single one of your identities, you would of course have to consider the ways that assumption can break down.

Lucas Kauffman

*that

Iszi

@LucasKauffman How the feck do you confuse "that" with "rhr"?

Lucas Kauffman

@Iszi r is next to the t on my keyboard

Iszi

8:30 PM

Oh, dur. You hit "r" instead of "t" and miss "a" entirely.

Lucas Kauffman

indeed

Iszi

Still, rhr's a lot of typos to pack together even within three keystrokes.

AviD

btw @Iszi I dont think that question is s&m, I think it would be a great theory type question. We do handle those on occassion, sometimes the most interesting ones.

@ton.yeung some might.

and welcome.... keep your head down.

Iszi

@ton.yeung The circle of "people who know something about web APIs and JavaScript clients" does somewhat overlap with "people who are in this room" in a Venn diagram.

AviD

@Iszi yeah, that's just the way @Lucas rolls....

@Iszi in a non-empty manner.

Lucas Kauffman

8:33 PM

@Iszi I've been making a lot of mistakes today :(

Iszi

@AviD Though one should note they are non-concentric.

AviD

@Iszi would "non-trivial" work?

@LucasKauffman dont go to a singles bar, then.

@ton.yeung define "secure it".

from injections? xss? logic bypass?

Iszi

@AviD I dunno. Depends on who's in the room. You the only one here that knows web APIs & JavaScript clients? Then, "non-trivial" definitely wouldn't work. ;-)

AviD

ah, you mean identity?

@ton.yeung was just saying to @Iszi how definitions are important, when it comes to identity :-)

@ton.yeung okay, so why dont you like dotnetopenauth?

Iszi

@ton.yeung Yeah, you need to be very specific about defining "identity" when asking questions of @AviD.

AviD

8:36 PM

I've used it, and I thought it was brilliant.

@Iszi heh.

one of my pet topics, yeah.

@ton.yeung 'course it only provides identity, and offloads authentication. You would still need to handle authorization.

@ton.yeung such as?

though this might be better over in SO/P.SE rooms... give it a shot anyway.

Iszi

@AviD You're still not on Twitter, are you?

AviD

in general I would say its the way to go.

@Iszi not really, why?

I might consider it, if/when I find a use for it.

Iszi

@AviD Was thinking about tweeting the "over 18" bit, and citing you via at-mention.

AviD

@ton.yeung ah. yeah, well, openid / openauth are not simple protocols to begin with. Other than that, the api seems pretty straightforward.

@Iszi haha, go right ahead.

use #AviD instead of "@"... ;-)

oo maybe we can get me trending!

#shitavidsays

Iszi

@AviD Didn't know you were into A/V...

Avid

@Avid, Worldwide

Creating the digital audio and video technology used to make the most listened to, most watched and most loved media in the world.

2k tweets, 27.4k followers, following 988 users

AviD

8:40 PM

@ton.yeung yeah, thats fair. What you want to do is encapsulate it in its own set of actions and probably its own controller. isolate everybody else from it...

@Iszi damn!

hang on, whats my username there.....?

Iszi

@AviD What, you do have an account?

AviD

@ton.yeung hmm.... interesting point.

you;d need to implement a wrapper of some sort....

Iszi

@ton.yeung SPA = Serious Pain in the Ass?

AviD

no wait, I seem to remember that you can force it to pop open a new window.

dont remember the parameters call....

that could fit as a specific q on Stack Overflow...

@Iszi have an "account", dont tweet or follow. needed it to sign up to something at some point....

@ton.yeung well, thats more of a openauth issue....

Iszi

@AviD Eh. Mind if I use whatever that is?

Xander

8:44 PM

@LucasKauffman +1

AviD

@Iszi meh. dont wanna go with #avid?

or just feel free to plagiarize.

Lucas Kauffman

huray

Iszi

@AviD Don't want to risk mis-representing a popular A/V company.

AviD

@ton.yeung wait wait, the user CAN'T login through your api, s/he has to login directly to the identity provider.

Iszi

@ton.yeung Defeats the point of OAuth and allows you to play MitM.

AviD

8:46 PM

@Iszi but if you really insist, its my full name...

@ton.yeung ah, well, if you get rid of oauth, then sure. What would you want to use instead, store and manage siloed passwords?

#FAIL.

Iszi

@ton.yeung What's that got to do with the price of tea in Guatemala?

AviD

@ton.yeung I didnt follow the thread there....?

@ton.yeung well yeah, thats the point of oauth.

Iszi

@ton.yeung Ok, wait a sec... Are you trying to "get rid" of OAuth as in you are currently using OAuth, or are you just trying to avoid using OAuth in a new authentication system?

AviD

but I didnt understand why "our users have not graduated high school" leads to " we have to store the bcrypt hashed passwords anyway".

Iszi

@AviD Or why "our users have not graduated high school" leads to "can't offload identity management" at all.

TildalWave

8:52 PM

Whatever is becoming of our dear programmers over at SO? SuperCollider question, so far 7 answers, only one trying to explain why OP doesn't get expected results, and none actually suggesting the most simple solution to OP's problems that is programming language agnostic:

I'm a bit disappointed so far with most of the answers here, for not mentioning another and utterly simple solution to your problem that would at the same time show where your approach is problematic: reverse your loop direction. As a programmer, you will often deal with loops through a set of items that will remove some of the items in the referenced set, resulting in such unexpected behaviour, so it's good to know your options and at the same time understand what is happening to your loop counter when you delete one of its set's items. ;) — TildalWave 6 mins ago

Iszi

@ton.yeung Ok. So, you're trying to choose an authentication mechanism and you don't want to offload it a-la OAuth. What's the reason you don't want to off-load?

AviD

@Iszi well, I understood that "can't offload identity management" is because "we have to store the bcrypt hashed passwords anyway"

@ton.yeung OAuth.

Iszi

@ton.yeung Pick one. Or all.

AviD

@Iszi No. Don't pick any.

That's the user's job. That's the point of user-centric identity providers.

I mean sure, some scenarios do call for limiting to a specific provider, say Google, or Facebook.

Iszi

@AviD Yes, but doesn't the site owner have the choice of allowing or disallowing use of certain providers? (Hence my giving the option "one or all".)

AviD

8:55 PM

@Iszi yeah, but in most cases I would claim that its uncalled for.

not from a security / identity sense, but from a business sense.

Iszi

@AviD I don't disagree. My point was that it really didn't matter - his options are wide open.

@ton.yeung Then educate them. E-mail isn't rocket surgery.

AviD

@ton.yeung there are providers that dont need email. though depending on their age, they could just open an account on one of those that you mentioned - its free ;-)

Iszi

@AviD +1 I'm pretty sure the standard minimum age is 13. Maybe lower for some.

AviD

@Iszi ah, yeah, then I agree. Was just trying to make the point that by default its an unneccessary choice to bother making.

Iszi

@AviD I think we were making the same point, but with entirely opposite statements.

AviD

8:58 PM

@Iszi yes, but if they are much younger than that, and technologically illiterate as @ton.yeung says, then I'm not sure any authentication or identity scheme will hold up.

sure, my son managed his own account, with a secret password, on club penguin since he was 5, but my kids are not typical.

@Iszi heh, yeah. Different emphasis, I guess.

@ton.yeung you said they didnt finish high school....?

Oh! thats what you meant! duh...

I assumed you meant "yet"...

Iszi

@AviD You know what they say about assumptions.

AviD

naw, I assumed, and made an ass out of me.

@Iszi ^

Iszi

@ton.yeung Get 'em to sign up for GMail, Facebook, and/or Skype, show 'em how they can use it to keep in touch with their grandkids, and let OAuth handle your authentication worries after that.

AviD

tell you what though, my mother (hush you) manages a facebook account just fine. and she fits "technologically illiterate" more than most.

TildalWave

@AviD I've never really expected DMZ to aspire to any heights, but I didn't realize the ceiling is so low newcomers need to be reminded of that fact :P

AviD

9:01 PM

@TildalWave oh yes. we've had a few victims.

@ton.yeung they dont have to.... could just be a "google account".

@ton.yeung can I ask what this system is? Perhaps with some more context, we can skip the generalities and focus in on your specific needs.

Iszi

@AviD Though that will inherently create an e-mail account for them - which they could choose to ignore.

TildalWave

@AviD good thing then it's not our workplace, otherwise health and safety would be crawling all over SE :)

AviD

@ton.yeung ah. So I have two very important points to make on this.

1. it is in their interest to move their arses and get used to the system, whatever it takes. Now shaddap about you not wanting email.

TildalWave

In case you haven't noticed, I need a few upvotes on that comment of mine that I posted here earlier... it's for a good cause, trust me. People need to learn counting backwards if they're expected to forget some things ;) :P

AviD

2. I am not sure that openauth actually IS a good fit - anything financial should be managed in a controlled manner. the problem with openauth, by outsourcing the identity management, it also outsources control of those identities. Not as in you need to control them, but that you DON'T want some random provider (even Google) controlling access to your finances.

Iszi

9:06 PM

@ton.yeung I think he likes to imply he has one when he doesn't, just to keep us guessing.

...or not.

AviD

It's about trust boundaries.

@Iszi hehe

yes, I always have another point. I just don't always share it with you.

Iszi

@ton.yeung See, we're back to definitions again. If you'd opened up with that, or with "this is for a system that tracks finances, etc." then I don't think any of us would have suggested OAuth - let alone tried to argue for it.

AviD

@ton.yeung naw, that point is irrelevant. You can simply have the user registration screen open a google registration screen, or whatever.

@ton.yeung no, I dont think they would - that is more of a net security consideration, I doubt the dealerships think in those terms.

@Iszi right. However @ton.yeung do take into account - you will need to implement a hella lot of user management functionality. It sucks.

@ton.yeung that doesnt really work that way...

@ton.yeung sure. and is it the same system, or a different instance?

@ton.yeung so it would be a different user account on the system then.

Lucas Kauffman

@ton.yeung I work a lot with financial institutions we would always advice against storing data at external service providers unless these are recognized financial institutions themselves (and even then it depends on the data classification) I doubt OAuth would be allowed as I think there also would be a serious legal framework involved about confidentiality and bank secrecy.

AviD

okay, now that we've got that sorted - @ton.yeung what was your question again? :-)

Lucas Kauffman

9:11 PM

:P

Iszi

Sadly, I must depart.

Lucas Kauffman

@Iszi I wish you farewell good sir.

TildalWave

@ton.yeung Sometimes, you can sell the horse as beef (depends on where your client is from tho) :)

AviD

@ton.yeung what is the client? web app, thick client...?

@ton.yeung France, not the UK.

Lucas Kauffman

@ton.yeung horse is pretty tasty though

AviD

9:14 PM

@ton.yeung oh right, you said SPA.

Lucas Kauffman

@ton.yeung wait you are handling sessions through javascript?

AviD

why not just use the API to create a regular web session?

sure, it should be stateless, but cmon we all know its not really anyway.

@ton.yeung .... and done.

let the browser handle it.

Lucas Kauffman

@ton.yeung your javascript should not be able to touch the session token

AviD

you just need to tie your controllers into the hosting web server (should I assume IIS/ASP.NET?)

@LucasKauffman hang on, he was simply trying to layer session management over REST.

@ton.yeung ah, that could make it a bit trickier....

so, lets take a step back a second

Lucas Kauffman

@JeffFerland how does facebook handle authentication?

AviD

9:17 PM

RESTful authentication really gives you two options, with a third I would rule out.

the third is doing it as method parameters. Ignore that one.

Jeff Ferland

@LucasKauffman Context? I just got here.

Lucas Kauffman

@JeffFerland RESTful service

AviD

The first is the "proper" way, via Authorization headers. The second, less proper, but still acceptable (by reason of extensibility) is session cookies.

@ton.yeung right. The advantage of cookies is its automatic, the browser handles it, the javascript cant touch it, and its well understood.

@ton.yeung right, but cookies are still a well-enough understood and accepted mechanism that they can be used by any client that speaks HTTP.

@ton.yeung not necessarily. I am not sure at all you should go that way... there is a lot more implementation complexity.

and too many ways to get it wrong.

with cookies, its pretty much built in, you just need to wire it up.

@ton.yeung the client? yeah.

doesnt matter what, any of your clients will be calling your API over HTTP - they can simply manage the cookies themselves.

@ton.yeung after the login call, it would read out the cookie from the response, and set it on every request...

@ton.yeung I think thats fair enough.

wouldnt be that much different saying "we use this Authorization header, deal wit it"...

but business-wise, you'd be better off discussing specific possible clients, see what they need, work it for them .

@ton.yeung talked to anyone specific?

.... now we're in Answers OnStartups territory...

@ton.yeung yeah, exactly. Probably simpler than the header... there are some clients where that would be tricky.

@ton.yeung "authentication". but yeah.

note that asp.net webapi is not automatically tied to the asp.net server - there is no implicit "session" or anything like that. so you'll need to wire that up explicitly.

@ton.yeung no, keep that on the server, in the session. the cookie should be just the session id.

@ton.yeung right, exactly.

@ton.yeung sfunny, right before you came along we were having a long discussion about when the two are conflated or confused.

its funny, because its so rare that we have a serious security discussion here, and now we have two right in a row, about similar topic...

@ton.yeung same same.

session id == authn token.

indirectly.

@ton.yeung not a good idea. usually.

@ton.yeung o_0

@ton.yeung are you sure? I'm familiar with it creating a standard session id...

anyway, I've gotta go. maybe someone else here can help, if you need anything more... good luck .

Adnan

10:04 PM

i meant security by performance not time consuming — BOB 2 hours ago

Christ on a cross!

AviD

just saw a great line, for GoT fans:

> A Lannister always pays his debts. For everyone else - there's Mastercard.

Adnan

@AviD The only think GoT fants want to hear is what Podrick did.

AviD

heh

Lucas Kauffman

@Adnan wow just read that

AviD

maybe he had a mastercard.

Lucas Kauffman

10:18 PM

how else do you measure performance?

Adnan

@LucasKauffman He means security

Lucas Kauffman

@Adnan security performance...

Adnan

"Is 128-bit AES more secure than 1024-bit RSA?"

Lucas Kauffman

so how long it would theoretically take to break the code?

Adnan

@LucasKauffman Yup, pretty much yes.

@AviD The only good 2-incher to get please women.

Lucas Kauffman

10:20 PM

Now my answer looks shit :(

Adnan

@LucasKauffman Oh come on, don't feel bad.

It looked shit anyway

Lucas Kauffman

fu :p

Adnan

@LucasKauffman In your dreams!

Lucas Kauffman

my dreams are filled with @ScottPack

AviD

@LucasKauffman now that's how you measure performance.

Adnan

10:23 PM

@AviD I bet @Scott's key is 8-bit.

3

AviD

@Adnan oh snap.

Adnan

Short and quick to crack.

Well, now it's not implied anymore.

Lucas Kauffman

@Adnan highly penetrable then.

Adnan

@LucasKauffman Oh Jesus! The image!!!!

Scott Pack

11:35 PM

@Iszi Technically it depends on how it's used. In the web proxy event based on source IP it would be an authorization thing, if it rang a phone then it could be used as an authentication token.

@Adnan I'm in yer dreams stealin yer sand

Transcript for