authenticated

When more and more transport employ end-to-end authenticated encryption like TLS and SSH, this will be a non-issue.

Openssl enc is basically a poor toy example, it's not a robust authenticated encryption tool for real world use.

You could offer authenticated profiles, where people can't lie on their resume about where they worked.

So typically an authenticated session would last months or years, rather than a few hours.

When using this, how do I get the information and token for the authenticated user in my app?

Encrypted and authenticated data on the bus won't happen anytime soon for cost reasons.

These days many SSL connections use authenticated modes of operation such as CCM or GCM that explicitly guarantee that data is transferred correctly.

If you get hacked from a machine your previously authenticated I guess Steam guard will not work.

The Maker Channel Action doesn't support authenticated requests, at least anything beyond something you could send in the URL or body of the message.

The blackbox I've focused on for this protocol is (arbitrary insecure physical bytestream in) -> [box] -> (arbitrary private, authenticated, integrity-verified bytestream out).

How does this handle authenticated requests?

>unlike the typical TPMs that only allow vendor software to be authenticated, these TPMs would allow the user to directly authenticate the firmware.

Maybe an authenticated write only to the low speed bus that you don't get to control the message, just "unlock all doors".

We do this to prevent people from using it to spoof requests to public authenticated services that might view such behavior as slightly "shady".

#15 - SQL injection, #21 - MD5 is unsuitable for password hashing, #25 - if an exception triggers you will automatically be authenticated, as "" == "", #28 - String comparison vulnerable to timing attacks 25.

Bank-Authenticated direct-debit (like giropay.de) is also useful for this.