Question about password to protect private key in IdpCredentials

[Chad La Joie]

Sorry, I guess we just disagree on this.  I throw password obfuscation
in to the "security theater" camp.  It doesn't really help but it
gives people a warm feeling.

On Wed, Aug 17, 2011 at 03:16, WULMS Alexander
<Alexander.WULMS at swift.com> wrote:
> We mainly use obfuscation (where possible) to protect against the so-called insider threat. It is combined with several other organisational and technical measures like segregation of roles and responsibilities, access controls, auditing policies and so on. You are right that it does not provide 100% protection but the combination of measures does raise the barrier.
>
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Chad La Joie
> Sent: Tuesday, August 16, 2011 6:30 PM
> To: Shib Users
> Subject: Re: Question about password to protect private key in IdpCredentials
>
> No, there is it.  Obfuscating the password is pretty much useless.
> Obviously the IdP will need to be able to reverse whatever
> transformation occurs that means it'll need Java code to do it and
> Java code is incredibly easy to decompile.  So, obfuscating offers no
> real added security benefits.  If people compromise your host, you're
> done, end of story.
>
> On Tue, Aug 16, 2011 at 10:54, WULMS Alexander
> <Alexander.WULMS at swift.com> wrote:
>> Hi,
>>
>>
>>
>> The IdPCredentials element (using the Filesystem X.509 Credential type)
>> supports usage of a password protected private key in order to sign the SAML
>> Response, whereby the password is stored in the (relying party)
>> configuration file.
>>
>>
>>
>> Is there a means to use an obfuscated password instead, whereby I would use
>> a (custom) java class to perform the de-obfuscation of the obfuscated
>> password stored in the config file? I suppose I could extend the
>> FilesystemX509CredentialBeanDefinitionParser class but which plugin point
>> should I start from and how much risk do I have on running into future
>> upgrade issues, knowing that this class is not part of the public API?
>>
>>
>>
>>
>>
>> Thanks and brs,
>>
>> Alex
>>
>>
>>
>> Alex Wulms
>> Lead Developer, Swift.com development
>> Tel: + 32 2 655 3931
>>
>> S.W.I.F.T. SCRL
>>
>> This e-mail and any attachments thereto may contain information which is
>> confidential and/or proprietary and intended for the sole use of the
>> recipient(s) named above. If you have received this e-mail in error, please
>> immediately notify the sender and delete the mail.  Thank you for your
>> co-operation.  SWIFT reserves the right to retain e-mail messages on its
>> systems and, under circumstances permitted by applicable law, to monitor and
>> intercept e-mail messages to and from its systems.
>>
>>
>> Please visit http://www.swift.com for more information about SWIFT.
>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
>
> --
> Chad La Joie
> www.itumi.biz
> trusted identities, delivered
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered