Google and Microsoft boffins playing nicely together to stop replay attacks in their tracks Google and Microsoft engineers have pooled their efforts to propose a protection against what are known as "replay attacks". These occur when an attacker steals something like a victim's OAuth token and uses it to impersonate them to access otherwise secured resources. The Token Binding Protocol is the next instalment in the …
Why are you storing certificates in an HSM?
Keys you store in an HSM. Certificates are supposed to be public. That's the whole point of certificates.
And the proposal suggests using keys stored in an HSM. They're not reinventing that wheel; they're suggesting you use it.
users access tokens being handed out to world+dog by the likes of Facebook.
You can even find the API's for grabbing users access tokens inside repackaged apps on third party app stores that are known for delivering malware/adware.
(Remember the Cambridge Survey?)
The real problrm is online payments. Never sign into your bank's website. Do not even get a password for it. Too many risks. You can do telephone banking more securely. On the other hand, it is best to enter the branch. Cash is king--not Google or Microsoft. I don't trust them with my wallet.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2023
