Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
93 views

Building a password recovery algorithm [on hold]

Assume that the client is registering for a service on some server. The client encrypts data using a key before sending data to the server. The server has an encrypted copy of the key and never sees ...
0
votes
0answers
19 views

Identify the attestation certificate (X.509) in Fido U2F registration response

I'm trying to identify the attestation certificate (X.509) in Fido U2F registration response as described in fido-u2f-raw-message-formats-v1.0-rd-20141008.pdf document: An attestation certificate ...
0
votes
1answer
52 views

Decrypting encrypted traffic with hacking an app [duplicate]

I am thinking how does telegram ensure that messages are secret. I understand they use the public key to encrypt and private key to decrypt. Why is it not possible for an attacker to download the ...
1
vote
1answer
25 views

Secure point to point remote access to NAS drive

This question is very similar but also distinctly different (How do I ensure data encryption on Samba transmission on *NIX systems?) I'm looking to set up remote access to a NAS unit locally sharing ...
1
vote
0answers
12 views

How to configure pam to use with two different passwords? [migrated]

Goal: I want to configure pam to use regular user password (pam_unix.so) and extra password. (with success only when I type both passwords correctly and deny (pam_deny.so) in case I type only one ...
2
votes
1answer
91 views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
0
votes
1answer
83 views

How to build a secure stateless authentication system for a client-side JavaScript application

i'm building a stateless authentication system for a Dart application (Dart gets compiled to JavaScript, so the whole application is an index.html file which loads JavaScript and runs in the browser) ...
0
votes
1answer
29 views

Best practices for encryption from web<-> specific client

If we want to allow sensitive data between a web server and specific client only, is there anything more that can be done besides the following? Note that this is potentially a duplicate of ...
0
votes
0answers
36 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
44 views

I want to figure out how cookies/ session variables interact to validate a user session [migrated]

---I have been experimenting on cookies/ session ids and have a little trouble digesting in the concepts. I'm working on a Debian distro. Using Burp to capture/alter requests/ responses. What I know ...
2
votes
1answer
62 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
3
votes
1answer
50 views

How is JWT implemented?

I'm using django-rest-framework-jwt in one of my APIs. As you might know, the concept is simple: you send username and password and you get a token back. The token is not stored anywhere on the ...
1
vote
0answers
29 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
12
votes
1answer
602 views

Why is the truncate function for HMAC one time passwords so complicated?

I've been reading through RFC4226 as part of some research and I was wondering why the function to truncate the HMAC was so complicated. As far as I understand it, the last 4 bits of the HMAC define ...
1
vote
1answer
28 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
0
votes
2answers
45 views

Is PIN-protected token with login certificate a two-factor authentication if the token is controlled solely by the user?

I know it isn't since the service the user is authenticating to cannot check the PIN correctness or existence. I need, however, to explain this to people who are convinced this actually is a ...
0
votes
1answer
37 views

Framework behind password reset mechanism

I have always seen those "Forgot password" links from web sites that requires some form of user login. Can I get a deeper understanding of how this works? What tools/framework do I need to use because ...
0
votes
1answer
44 views

Google Accounts login - is it good enough for financial services?

I am wondering - is using Google Accounts login (in a setup similar to this) secure enough for financial services (you can assume that if someone logs into your account, your money gets stolen)? On ...
11
votes
3answers
278 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
-1
votes
0answers
19 views

OpenID is the successor of Oauth2? [duplicate]

I started to learn the two new protocols Oauth2 and OpenID, but i guess that they do the same thing ! how can i differentiate between OpenID and Oauth2. Thanks
-1
votes
0answers
26 views

Windows integrated Kerberos authentication

I understand Kerberos as "a computer network authentication protocol which works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another ...
4
votes
3answers
278 views

SSH Public Key Authentication vs Username/password for API Access

I have a linux device that will be making periodic call to an API server, say everytime the system boots up. Everytime then it should authenticate itself and then do its thing. I can either store the ...
0
votes
3answers
47 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
6
votes
3answers
920 views

How were resources shared before OAuth?

With OAuth 2.0, it is pretty straight forward for a developer to authenticate a user via another service in order to obtain its data, e.g. get tweets from a Twitter user or fitness data via RunKeeper, ...
1
vote
0answers
59 views

Authentication and Authorization for a simple Web Site [migrated]

I'm struggling with these concepts and having trouble finding good resources on the web. We are looking for ways to switch out custom implementations tightly integrated into our application for ...
0
votes
1answer
18 views

Pre-Requisites for Mutual Authentication

For Mutual Authentication, the client must contain the CA certificate of the Server and his own Certificates, and the server must contain the CA certificate of the Client and his own Certificates.In ...
3
votes
2answers
91 views

Obscure username input on login forms?

Not (necessarily) a duplicate of: Should both user ID and Password be masked for online banking? Definitely not a duplicate of: Should usernames be kept secret? I can sense your finger on the "mark ...
0
votes
2answers
63 views

Is CAPTCHA necessary when I use token?

I wonder is it a good idea using captcha when using token on login page? I think it's impossible for robots to mess with login page because token changes on every request. Thanks.
0
votes
0answers
14 views

Combining Hash Visualisation (VisualHostKey) and SiteKey to prevent MITM

TL;DR Skip to the No SiteKey + Plugin if you don't want to read this whole thing. VisualHostKey shows an SSH hash like this: # Host github.com found: line 53 type RSA 2048 ...
1
vote
1answer
17 views

Purpose of Initialization Vector in File Encryption and Authentication (FEA)?

I came across this schematic of FEA implementation using RSA and AES: Suppose that PKB is Bob's public key, PKA is Alice's public key, SKB is Bob's private key, SKA is Alice's private key, Ks is the ...
1
vote
2answers
72 views

Does the secure attention key really increase security?

Are there any statistics on whether requiring the secure attention key to be pressed on login actually increases security ? I personally don't see the point of that : if you're after credentials, ...
2
votes
3answers
135 views

Is it okay to only use username/password to secure an admin page for moderating a website?

Is there a standard practice to securing an admin page for an application written in angular and nodejs or just in general? The admin page would approve/ban users and moderate comments. Should it be ...
0
votes
1answer
69 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
0
votes
0answers
20 views

Unable to authenticate with Client cert in TLS1.0 [migrated]

I have my own application running in Windows machine (server). I am using a browser as a client to do operations. I have multiple users connecting to the server using client certificates as the ...
3
votes
1answer
99 views

How can I successfully perform an xss attack on a dummy website? [closed]

in my security course, we were told to practice an xss attack using firefox on this website; http://permalink.co/ No worries, this is a website specifically setup for us to practice ...
3
votes
2answers
102 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
3
votes
2answers
63 views

Why would you decouple your resource and login servers?

As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
3
votes
1answer
83 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...
0
votes
1answer
43 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
0
votes
0answers
14 views

Is OpenID Connect (OAuth2) appropriate for standard login + social login + single sign on? [migrated]

I have to implement authentication in a group of websites. The solution will have to support standard login (user & password), social login (facebook, google+, twitter) and single sign on (once ...
0
votes
1answer
59 views

Security tradeoffs while designing a mobile Web Service API

I'm not a security expert but I want to ask about tradeoffs in a web service API I'm designing for mobile apps. It is an API which tracks users' locations so yes, the data is reasonably sensitive. ...
0
votes
0answers
14 views

Difference between Kerberos and GDOI

What is the difference between Kerberos and GDOI, I know first is more toward authentication and latter is more toward multicast key management, can I use Kerberose protocol in GDOI for server and ...
0
votes
0answers
17 views

Difference between Kerberos and GDOI?

What is the difference between Kerberos and GDOI, I know first is more toward authentication and latter is more toward multicast key management, can I use Kerberose protocol in GDOI for server and ...
1
vote
1answer
616 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
1
vote
1answer
29 views

Why should I include a client_id in an OAUTHv2 password grant request?

Like little red riding hood, you don't know who is knocking on the door... Why even bother accepting a client_id in case of a API <-> Javascript-website or API <-> Android App password grant ...
0
votes
0answers
8 views

Tomcat client certificate authentication, client certificate not sent [migrated]

I've add client certificate based authentication on our Tomcat servers. Both client and server are tomcat servers with internal CA issued certificates. Each tomcat has its own keystore (PKCS12) ...
1
vote
1answer
68 views

Limiting Login Attempts [duplicate]

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
1
vote
0answers
28 views

Spring-MVC : Encryption/Decryption with user password [migrated]

I am working on a Spring-MVC application which uses Hibernate as the ORM and PostgreSQL as the database, in which I am looking for on-the-fly encryption decryption solution, but only for 2 columns in ...
1
vote
1answer
39 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
0
votes
1answer
59 views

Why first kerberos message is not ciphered

When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted. In case not encrypted I ...