authentication - Security model: log in to third-party site with user's credentials -


i develop service (service) automates actions users can on third-party site (3rd party site).

my service provides following functionality users:

  • the user registers @ service

    1. the user provides his/her 3rd party site username/password service
    2. the service uses credentials log in 3rd party site on user's behalf
    3. the service stores cookie issued 3rd party site in database
    4. from on, service starts log in 3rd party site regularly (cron) on user's behalf using stored cookie (the username/password 3rd party site not saved anywhere) , performs actions on users behalf on 3rd party site

use case diagram

notes:

  • before registering on service, user presented full information describing interaction between service , 3rd party site
  • there value in automating user's login 3rd party site , users interested in automating logins , actions on 3rd party site, i.e. interested in service doing work them @ 3rd party site
  • there no oauth functionality on 3rd party site
  • there no user authentication token functionality on 3rd party site

i have made research here @ stack exchange , have not found solutions:

moreover, reading through provided questions , answers tend think there no way secure user's login data (passwords or 3rd party site cookies). i.e. if attacker gets access service's server, attacker gets access users' accounts on 3rd party site well.

if try store 3rd party site's cookies in service's database encrypted, useful script decrypts them. therefore, access 3rd party site user account, attacker need not access service's machine, modify script (step 4) well.

storing cookie 3rd party site on service similar oauth, in case cookie used instead of token (no passwords stored).

what way design security model/architecture securely store user's login data @ service allow service login third-party site on user's behalf regularly without manual interaction user?

p.s. use django, guess security model/architecture not depend on technology stack.

to state obvious: important thing here of course not let attacker on site access cookies. cannot protect against this, since service need access cookies (in unencrypted form) regularly. attacker has compromised server in theory able service can do, if possible service access cookies, attacker rights able access them.

if still want this, should

1) make more difficult attacker access cookies

just give example of how can think this: if system compromised, attacker access file system. if cookies stored in plain text on files, attacker have easy time. storing them in database better (and want anyway), not better unless protect access database in way. dedicated attacker not have hard time if i.e. password database stored in applications configuration file.

a solution improve situation quite lot if cookies encrypted except when need them. best solution if encryption key not stored in application log, provided (typed in) operator every time server restarted. break attacker have read memory of application (not impossible @ all, still more difficult).

another measure store cookies in separate database on dedicated server , limit access server needed.

a complete strategy requires more intimate knowledge of exact physical , logical setup.

2) create mechanisms can detect if cookies compromised

this equally important. if happens, want know , able take action immediately. there of course standard ids systems can used. may create more targeted systems applies spesific application. system i.e. detect if running sql scans whole database table cookies. since know how own application behaves, can create monitoring system can detect if not normal happens.

3) prepare system invalidating cookies if detect stolen

the third party services have option log out , invalidate cookies. should prepare job stored cookies can activate. think difference in telling users may have had access service in 10 minutes before disabled cookies , telling them still have access third party service , don't know how stop them.

in addition this, of course important users understand when give access , provider of third party services approves of this. not obvious third party service provider allow kind of access. if do, may creating special session cookie i.e. bound ip address.


Comments

Post a Comment

Popular posts from this blog

html - How to style widget with post count different than without post count -

i have border below li elements in wordpress widget types appropriate. element inside set block gives them nice easy click full width. the problem, when choose option "show post count" when adding widget such categories or archives displays post count plain text after tag , because tag block pushes post number text line below. whether choose show post count or not show post count still gives exact same element identifyer example "widget_categories". how style post count not on next line still keep links non post count list items full width? here's example on sidebar www.bbmthemes.com/themes/modular/blog-standard/ in order solve problem need remove display:block; for ul.widgets ul a , add in it's place line-height: 33px; what going achieve have same visual effect. what going lose doing links going work on text , not on "box". the other way out of find post count coming , make changes this. example change text count i
Read more

How to remove text and logo OR add Overflow on Android ActionBar using AppCompat on API 8? -

have researched death , cannot find answer. i have actionbar using appcompat. supporting api v7 (api v8 do). actionbar works api v11. api < v11 has problem of removing icon (and feature) actionbar without supplying overflow. big picture have app logo, app title, , 3 icons squidging same actionbar on low end phone. trying make room! i happy 1 of 2 solutions. either: a method of getting overflow functionality can retrieved pull down. (preferred) method of removing icon , text actionbar below current xml api 11+: <resources> <!-- base application theme api 11+. theme replaces appbasetheme res/values/styles.xml on api 11+ devices. --> <style name="appbasetheme" parent="theme.appcompat.light.darkactionbar"> <item name="android:actionbarstyle">@style/liteactionbarstyle</item> <item name="actionbarstyle">@style/liteactionbarstyle</item> </st
Read more

javascript - storing input from prompt in array and displaying the array -

i want take the inputs user prompt, store input in array, , display it. want take 10 inputs user using for loop. have tried do-while shown below. var givennames = new array(); var pattern = /[\w\d]{1,}/ig; do{ var name = prompt("enter names. letters , digits accepted!\nentering empty field stops asking",""); if(name && name.match(pattern)){givennames.push(name);} } while(name != ""); function displaynames(){ if(givennames.length > 0){ document.getelementbyid("list").innerhtml = "<span style='color:navy;font- weight:bold;'>given names are:<\/span><br><br>" + givennames.join("<br><br>"); } else { document.getelementbyid("list").innerhtml = "<span style='color:navy;font-weight:bold;'>nothing has been given!<\/span>"; } } how replace for loop? var givennames = new array();
Read more