Reverse engineering ASP.NET Membership passwords and salts
I’m working on a project that was using the ASP.NET SQL Membership and I needed to remove the Membership provider from the system since we wanted more control over the…
Caching results of .NET IEnumerable generator methods
If you’re already familiar with generator methods and want to jump to intelligent caching of their results, skip further down in this blog post. In C#, generator methods are methods…
Uri.EscapeDataPath and HttpUtility.UrlEncode are NOT the same
For some reason Microsoft defined URI escaping twice: Uri.EscapeDataString and HttpUtility.UrlEncode seem to cover the same need. There’s another pair: Uri.EscapeUriString and HttpUtility.UrlPathEncode which again seem to be redundant with…
Recent OpenID relying party vulnerabilities
The OSIS I5 OpenID interop testing is well underway. Last weekend while testing some OpenID relying party web sites, John Bradley happened upon a web site that failed a particularly…
DotNetOpenAuth 3.0 released
Download it now. Previously named DotNetOpenId in its v1.x and 2.x releases, the v3.0 release is rechristened DotNetOpenAuth to reflect its support for multiple authentication and authorization protocols. Sporting OpenID,…
How to pretty much guarantee that you might get an email address with OpenID
OpenID itself is just an authentication protocol. It takes OpenID extensions to get more information about the user like their name or email address. In fact there are two popular…
Need access to that internal? Don’t touch that dial!
The blessing and curse of open source is that the source can be easily changed. Internal types and members don’t need to be backward compatible with previous versions. This makes…
DotNetOpenAuth 3.0 Beta 2 released
DotNetOpenAuth, previously named DotNetOpenId, is getting nearer to its major 3.0 release. With beta 2, we have a security reviewed, feature complete library for .NET use of the OAuth and…
Replay protection for OpenID 1.x relying parties
If you’re writing an OpenID Provider, you should have a strong appreciation for the security of your customers’ identities that you will be protecting. One aspect of that protection is…
OpenID association poisoning
As part of the OpenID protocol a relying party often establishes shared secrets (called ‘associations’) with identity providers that are used to verify identity assertions. It occurred to me that…