3 ms·
btw: isn't the scheme you posted vulnerable to replay attacks too? Much easier than the timing attack. edited to add: don't mean this as a nitpick. I've seen t
by bazzargh 13y ago
btw: isn't the scheme you posted vulnerable to replay attacks too? Much easier than the timing attack.
edited to add: don't mean this as a nitpick. I've seen that very mistake made by two S&P 500 companies that had 'homebrew' SSO we had to integrate with.
- alinajaf 13y ago> btw: isn't the scheme you posted vulnerable to replay attacks too? Much easier than the timing attack. Yep, probably. In fact now that I look at it definitely, I should have gone with that instead! I forget who said this but basically any feature that exists in TLS that doesn't exist in your hand-rolled authentication scheme is a vulnerability.
- mcintyre1994 13y agoDoes peer review count as a feature?