elblanko

2 ms·

1. 1.▲
   by elblanko 8y ago

   I agree that CryptoAPI is nasty, but if your key doesn't have the CRYPT_EXPORTABLE flag set when it was created then it can not be exported by CryptoAPI, and can only be accessed maliciously by breaking the CryptoAPI (by patching it in
2. 2.▲
   by elblanko 8y ago

   I think most linux distro's protection of certificate private keys is pretty weak (just storing a .pem file somewhere) and I can't say anything about OSX but on Windows you can prevent the private key from being disclosed even if
3. 3.▲
   by elblanko 8y ago

   OpenId, OAuth, et al are similar to Kerberos: Using a central authentication server to issue tokens that are trusted for authentication to a third party. OAuth seems a little bit weaker compared to Kerberos since there is no mutual authenti