Recent content by gary

  1. gary

    Handling 302 redirect from CPS

    Yes, I was able to work around the issue. I ended up storing state in the client so that the JavaScript can remember where it was before the browser handled the 302. I am not using a reverse proxy, but I don't see how that in itself should cause extra issues. I would think you could just...
  2. gary

    Handling 302 redirect from CPS

    Ok, I think I see what you are saying. You are not just concerned about a MitM deployed as a reverse proxy at something like www.evilamazon.com but also some potentially untrusted JavaScript running in the browser. If it did get a hold of the CPS session id it might be able to simulate a...
  3. gary

    Has anyone tried implementing sspapi with this?

    Right, @PHolder . I just used that api when I created by own backend. It basically abstracted out all the crypto stuff so that my app doesn't need to have any crypto libraries installed, nor does it need to communicate with the SQRL client. It's a useful abstraction for me to essentially have...
  4. gary

    Has anyone tried implementing sspapi with this?

    I have an application where I created a Spring Security authentication provider. It handles the cps session by making sspapi calls to another server. I'm currently using the VM provided by @Steve in another thread to handle all of the crypto. It seems to work fine, but it requires an entire...
  5. gary

    Handling 302 redirect from CPS

    One thing I'll also point out is that this issue does not exist when testing against @Jaap chrome browser extension. There is no 302 redirect upon successful authentication, since his code is just JavaScript in the browser, I'm assuming he is just changing document.location.href directly to...
  6. gary

    Handling 302 redirect from CPS

    So I am working on integrating SQRL authentication to an angular application. I modeled the JavaScript used based on this working example from @Steve This is the part that is causing trouble for me: //============================================================================// // When we...
  7. gary

    Introducing "IdTool": A utility to view and manipulate SQRL identities

    FYI - I can confirm these build instructions to work perfectly now on Ubuntu 18.04 LTS.
  8. gary

    Introducing "IdTool": A utility to view and manipulate SQRL identities

    Thanks for looking into this, @Sithmagic Indeed, I am running QT version 5.5.1. Perhaps a software upgrade is in my future...
  9. gary

    Introducing "IdTool": A utility to view and manipulate SQRL identities

    Ok, I can confirm that the install step does complete if you use build-essential package. I am using Ubuntu 16.04. However, the make step fails with this error: g++ -c -m64 -pipe -O2 -std=c++0x -Wall -W -D_REENTRANT -fPIC -DQT_DEPRECATED_WARNINGS -DAPP_VERSION=\"0.3.0\" -DSODIUM_STATIC...
  10. gary

    Introducing "IdTool": A utility to view and manipulate SQRL identities

    I'm getting this error at the apt install step: $ sudo apt install qtcreator qt5-default build_essential Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package build_essential Maybe it should be build-essential instead? ( a...
  11. gary

    Does the SSP API allow a SQRL identity to log into more than 1 web acct?

    I can see the advantage for having multiple identities stored in the client like Steve's GRC Windows client apparently does. Each time the user logs in, the client would send a completely separate idk to the server that represents the user. There would be no way from the SQRL protocol point of...
  12. gary

    Does the SSP API allow a SQRL identity to log into more than 1 web acct?

    I've been messing with the sspapi as described here I am using Steve's Windows sspapi implementation for testing. The server I am working on has two usernames, one named "admin" and one named "regularjoe". I have changed the login mechanism to allow either username/password or sqrl to login...
  13. gary

    Introducing "IdTool": A utility to view and manipulate SQRL identities

    Hi Alex, I'd like to try out your tool on Ubuntu Linux. Do you have a compiled executable? Or maybe Linux build instructions?
  14. gary

    Can a SQRL-Server serve many webapplications?

    I was wondering about this too. I am working on a server side solution using Spring Security. When I use the chrome SQRL plugin-in client, I notice that it shows the full hostname of the server the webapplication is authenticating to. When my app is running under localhost and authenticating...