Timeline for Understanding token security
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 17, 2019 at 8:48 | vote | accept | user1156544 | ||
| May 16, 2019 at 23:00 | comment | added | Squeamish Ossifrage | @user1156544 The reason it's not a big deal is that the adversary is extremely unlikely to learn the token and not have a better use for it than revoking it. They can't guess the token, and if they obtain the token from a breach they can probably do something more nefarious with it than simply revoke it. | |
| May 16, 2019 at 22:54 | comment | added | user1156544 | "What I meant is that..." - Yes, but this means that Squire (or Google/Apple Pay) will store credentials per site per user. "maybe it's not a big deal to let anyone on the planet ask to revoke any particular token" I think this will denigrate part of the system, since the credit card might have to be transferred every single time | |
| May 16, 2019 at 22:22 | comment | added | Squeamish Ossifrage | @user1156544 I have no idea what the revocation protocol is. Presumably after a breach at Home Despot there will be some way for them to say ‘uh oh, Squipe, I got owned, please toss the cookies’. Maybe there's also a way to revoke individual tokens; indeed, if you allowed just anyone to revoke individual tokens, the only damage is potential denial of service—which would require an adversary to learn the token in the first place, so maybe it's not a big deal to let anyone on the planet ask to revoke any particular token. | |
| May 16, 2019 at 22:20 | comment | added | Squeamish Ossifrage | @user1156544 What I meant is that Evelyn T. Shopster registers an account at Home Despot's web site, which has some web thing that calls out to Squire to actually store the data. Clearer? | |
| May 16, 2019 at 22:19 | history | edited | Squeamish Ossifrage | CC BY-SA 4.0 |
Clarify that it is through Squipe's API that the Home Despot API creates this token.
|
| May 16, 2019 at 22:16 | comment | added | user1156544 | Just a clarification, since Home Despot don't know your card, the token has to be created by the bank, as I think you say in (3). In that case, are banks going to keep track of all clients tokens, one for each shop they visit? In your system, the token is computed by Squipe, and then sent to HD. I suppose that Squipe can only distinguish between a legitimate request to change tokens by HD (because they have been compromised) or a malicious one because the request should come with the old token + the credit card information | |
| May 16, 2019 at 21:48 | history | answered | Squeamish Ossifrage | CC BY-SA 4.0 |