Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

11
votes
3answers
840 views

What are the disadvantages of implementing HTTP authentication in a web application?

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
-1
votes
0answers
34 views

Amazon login request on port 843 to fnes.amazon.com [on hold]

I wonder if anybody knows why amazon, on their login page (both for amazon.com and for aws console login) does a request on port 843. This request is apearantly to name fnes.amazon.com My question is ...
-1
votes
0answers
15 views

Drawbacks of OpenVAS [on hold]

Delibrate on any major vulnerability detection capability missing in OpenVAS compared to its commercial alternative solutions. Please.
-2
votes
0answers
13 views

DB vulnerability OpenVAS [on hold]

Could anybody comment on the strength of OpenVAS for detecting DB vulnerability.
-4
votes
0answers
35 views

How to find Database attack in my site? [on hold]

When i open my site admin i cant able to view the booking details.But booking is stored in Data Base.Is there any attack in my site? Yes means how can i find and solve it?
2
votes
0answers
36 views

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
0
votes
0answers
9 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
0
votes
1answer
58 views

Idea for an algorithm to authenticate users with zero-knowledge-proof [need thoughts/review]

I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it. This would work as an (almost)zero knowledge proof for sending passwords that can ...
1
vote
1answer
70 views

Authentication between two internal servers

I have two internal servers that are going to communicate with each other; they speak HTTP/TLS. Is there a best practice for authenticating communications between internal servers? Short of a best ...
0
votes
2answers
24 views

Ubuntu backup to only specific devices

I am looking into setting up a secure Ubuntu server with daily backups to two different external hard drives that will be swapped with the external hard drive that is stored in a safe deposit box. ...
-3
votes
0answers
28 views

What forms of two-factor authentication are used by the Healthcare industry? [on hold]

I know fingerprint and usb tokens are used. Not sure if other schemes are used. Primarily hospitals and insurance providers.
2
votes
5answers
222 views

Can extra loading times on login attempts be a security threat?

I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password. Since I'm using the PHP native (slow) hashing ...
8
votes
1answer
873 views

Why would HTTP client only send authentication headers once an unauthenticated request was rejected?

The default usage of HttpClient and HttpWebRequest .NET classes is setting Credentials property and then asking the class instance to perform an HTTP request. If the target requres Basic authorization ...
1
vote
0answers
38 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
9
votes
4answers
202 views

What kind of factor is a physical signature?

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified: Is it ...
51
votes
10answers
11k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
3
votes
2answers
65 views

Link Layer authenticated encryption vs authentication

Many security articles discuss about adding an extra layer of security at the link layer by either authenticating the data at the link layer authenticating and encrypting it. If we have ...
1
vote
0answers
45 views

Does Ally Bank's trusted image system actually make login safer? [duplicate]

Ally Bank uses a 'trusted image' system to supposedly make login more secure. I can't find evidence that this is standard practice, so I'll explain it. When creating an account, you choose an image ...
2
votes
7answers
301 views

Is it wrong to root login with SSH?

I've long been under the impression that with unix, you should never login as root. Now I've started using Virtual Private Servers over at DigitalOcean, and some advice is to use SSH keys to login as ...
4
votes
2answers
130 views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
0
votes
0answers
12 views

Prevent Derby SQL User Authentication Change [migrated]

Can someone tell me if there exists SQL code for Derby to change a username or password of a database? How may I reproduce this to prevent it in future in my application? What I'm busy doing, is to ...
1
vote
3answers
150 views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
2
votes
1answer
88 views

How to autenticate properly in Java

I have to write some login module for Java EE application. Previously i was using JBoss security - provided login and password, called HttpServletRequest with login method and JBoss security did the ...
0
votes
0answers
33 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
1
vote
0answers
26 views

Using a bearer token to get a federation token from ADFS

Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token. Is there a specific ...
3
votes
3answers
102 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
1
vote
1answer
34 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
2
votes
1answer
74 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
1
vote
2answers
92 views

Which encryption technique should be used for cloud computing data transfer?

I want to setup my application for cloud computing for Software as a Service. There is going to be a lot of data transfer between my server and client, to and fro. The technique I have envisaged is: ...
1
vote
2answers
45 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
4
votes
4answers
127 views

Which one to ask first in multi-factor authentication?

Let's say I have a system which use something you know, like a password, and something you have, like a code sent to a cell phone, to authenticate. Is there a preferred order to ask for the password ...
1
vote
1answer
78 views

Shared Key vs Pre-Shared Key

Does Shared key and Pre-shared key mean different thing ? Currently reading Text , Security+ Guide to Network Security Fundamentals.
28
votes
4answers
2k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
2
votes
1answer
104 views

How can I protect my “try it with one click” service?

I have a service with "try it now" experience that currently offers a "one click" effort. This service has a pool of N resources (lets say 50). Each new resource takes about 1 hour to generate. ...
14
votes
6answers
960 views

Additional security benefits from Multi-Factor Authentication?

Does multi-factor authentication provide any additional security benefits on top of doing a better job at correctly identifying and authenticating users compared to single factor authentication? In ...
1
vote
1answer
52 views

Logging in users automatically on a website

I'm making a website that has an extended forum feature, where users can login, post comments, etc. I'm making the feature where the website stores cookies in your computer so the next time you visit ...
2
votes
3answers
115 views

Example of application that doesn't require “strong authentication”

Does anyone have any examples of real-life applications that doesn't require "strong authentication". I am looking specifically for blog posts or even scientific papers that argue that "strong ...
0
votes
2answers
70 views

https login iframe 2014

Per current security recommendations & browser support, is it okay to have an https iframe in an otherwise http-only set of pages? Is this not a dupe? It is, but I want current trends because ...
0
votes
2answers
72 views

Can a mobile number ring if the person has not inserted their simcard into their phone? [closed]

I dialled a cell phone number and it rang but with no reply. I asked the person later why they did not answer and they said the Sim card was not in the phone. In fact, it was in a purse.... Is this ...
-3
votes
2answers
66 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
1
vote
1answer
131 views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
2
votes
1answer
68 views

Is this a safe way to identify users connecting to a chat server?

Before I start, all information will go over HTTPS. So, my website is basically like a forum with the authentication part finished and working. This forum has a real time chat application that sends ...
0
votes
1answer
39 views

How to maintain validity of user credentials?

In an example scenario consider that; I am a customer of organisation and I have two separate accounts with two different departments X and Y. I can login in to each department's website by using ...
-1
votes
1answer
79 views

VPN security/compromise

I want to get a VPN with one of the known providers. I don't know much about VPNs but I know they issue certificates which you download and it authenticates the connection and basically gives access. ...
2
votes
1answer
40 views

Possibility of using CA as an attack point by governmental organizations under their pressure

I was always concerned about the model of trust behind CA stuff we use . Well, for most of us, it is OK to trust them, since they are reliable organizations with a bunch of solid experience. ...
-1
votes
0answers
30 views

Considerations for distributed authentication with online/offline app?

I am developing an application that will exist across three groups of machines: 1) A central web server. This is a publicly available site accessible via http. 2) Browser-based clients. Any number ...
0
votes
2answers
60 views

Securing login form in a desktop app

I currently have a desktop application which requires the user to have a username and a password. These credentials are stored on a webserver (myserver.com), so when he types the username and the ...
-1
votes
1answer
50 views

How do I force kill an OWA, Activesync, or Outlook session?

A user with a BYOD is still able to access the email system, even after the user account has been disabled and password changed. Since it's clear that a re-authentication event doesn't continually ...
0
votes
2answers
75 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
-1
votes
1answer
101 views

Strange name on “shared”, was I hacked?

I use a Macbook Air 2013 and I recently noticed a very strange and long line of digits and letters under my "shared" category in finder. When I click on the name, it just says "failed to connect." It ...