Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
41 views

Password-less authentication using corporate Active Directory on external (internet) site

I need to restrict access to an external site so that: users who are in the corporate network have full access to the site's functionality, those who are not - only limited functionality. In the ...
1
vote
2answers
30 views

Public/private key auth and VPN

If a server uses public/private key authentication to access SSH, will there be any advantage of restricting the access of SSH over VPN? This link describes both approaches to solve brute force ...
1
vote
1answer
156 views

Why AJAX is not used to log in?

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?
1
vote
2answers
68 views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...
0
votes
1answer
39 views

vpn and strong authentication, how does the two work as a pair?

Dont know. maybe I was to unprecise.... I basically am asking if a SSL-VPN solution is solving both the encryption and the authentication, like that the user authenticates himself to the vpn-client ...
8
votes
2answers
453 views

Can an attacker “simulate” a private IP address?

I have a SSH server with a rule that does not allow password connections outside the local network. So people already on the local network, either physically or via VPN, are allowed to connect with ...
4
votes
0answers
59 views

Security protocol for NFC stickers/cards

Lets say I'm using NFC cards for access control. NFC cards/stickers are easily readable and writable, so my worry is that the data on them could easily be cloned onto another card/sticker and bypass ...
1
vote
1answer
22 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
2
votes
2answers
74 views

Openssl ciphers: what does Au=ECDH mean?

I am trying to get a grasp on different stages of SSL. I have referred to some fantastic answers about how SSL/TLS works and specifically about authentication mechanisms, and numerous other sources. ...
1
vote
1answer
78 views

Check HMAC after completing decryption or before?

I have written a piece of software that symmetrically encrypts big files (multi-megabyte). Plaintext is encrypted, after the encryption the HMAC is calculated and written into the header of the file. ...
1
vote
0answers
39 views

Time Based Authentication

I need a way of authenticating that a file was generated by a particular machine that has a unique ID and a unique random secret also known to the authenticator, as an added difficulty the file ...
-1
votes
1answer
20 views

RADIUS use outside of network AAA

I've seen RADIUS used for wireless authentication, but are there any other use cases that RADIUS works well in? Has anyone had experience with using RADIUS for AAA between two applications? I'm ...
1
vote
1answer
50 views

Can a 0800 and 00800 be from different companies in UK [closed]

I recently received a call from a 00800 number, that seemed like a prerecorded message asking me to press some keys to continue. I disconnected. I later googled the number and I noticed that a ...
0
votes
0answers
15 views

At OpenSSH ssh server side key files has 0 data. I would like to know the reason for it

I am using the Monta Vista Linux. In this recently i have observed the ssh keys files has 0 data due to which the keys were not generating and i am not able to login to machine via ssh because of key ...
2
votes
1answer
68 views

Multiple logins on the same website

If a hacker uses MITM in an open WiFi network, he can easily grab plaintext passwords so that he can login from his PC and change it. Is there any solution for this? I wonder when we log in to ...
1
vote
1answer
36 views

SSL cert vs public-key authentication

If SSL/TLS uses a pre-created certificate why does it also use public-key ciphers such as RSA and ECDSA for authentication (I do not mean MAC integrity)? Are they related?
1
vote
2answers
72 views

Is it Safe to Send an Invalid Password Back to the Client?

It is common for websites to remember the username input value after an invalid login attempt but not the password input value. Take SE for instance. When I attempt to login with an invalid password: ...
1
vote
1answer
42 views

Should I show the security answer when the user goes back to edit the field?

So when a user signs up to create an account, they are required to select select questions and enter security answers. Once they do that, they can proceed forward to a review page that shows them the ...
-1
votes
1answer
75 views

Is this process a secure way for users to login? If so, is there a name for it already?

I thought of this process specifically to stop "man in the middle" attacks and replay attacks: User types their username into the client application. Client application sends the username to the ...
2
votes
0answers
34 views

Using RSA-SHA as/instead HMAC in OpenVPN?

While reading the manual of OpenVPN 2.3, I came across the --auth alg option. The manual says: Authenticate packets with HMAC using message digest algorithm alg. (The default is SHA1 ). HMAC is a ...
2
votes
1answer
31 views

Saving Authentication Tokens to Third-Party Websites

So Flickr allows you to authenticate users to your app via app_key and secret and returns an authentication token. I want to securely save that authentication token in my database, but also be able to ...
2
votes
1answer
132 views

Is it a safe to hardcode my secret key in my iOS app?

Cloudinary iOS SDK configuration suggests to hardcode your api_secret in your iOS app's source code. Isn't that a security vulnerability since string literals can be extracted from the app binary, ...
1
vote
2answers
95 views

how to do 2 way ssl authentication without using a self signed CA

I have a requirement to set a 2 mutual ssl authentication between our apache and an application. I have purchased a cheap SSL from rapid SSL in order to do this. RapidSSL sent a zip folder with ...
3
votes
1answer
43 views

How can I make sure that the incoming file is definitely of the expected file type?

I have a program to check if incoming files are in an expected filetype, e.g. PDF. The program first takes a look at the magic number, and determines the file type out of that. The problem is that I ...
1
vote
3answers
64 views

What are the disadvantages of combining client-side and server-side authentication security?

Imagine situation: Application might or might not be run via SSL/TLS Application should not know password of the client because client might reuse passwords Wouldn't then combined client-side and ...
1
vote
1answer
36 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
1
vote
1answer
26 views

Authentication between to devices where the same password is used on both

I'm writing two applications that are intended for execution on two separate devices. It is similar to a remote desktop solution such as TeamViewer. What follows below is my proposal for an ...
0
votes
0answers
21 views

SSO implementation in a mobile application

We are currently in the process of implementing SSO for one of our enterprise client in our mobile application. To make it more user friendly we were considering the idea of adding a new endpoint to ...
1
vote
3answers
101 views

How YubiKey Challenge-Response works “locally”?

I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed). In password managers those support YubiKey, ...
1
vote
0answers
27 views

JWT for User Authentication + Client App Authentication + User Claims Holder?

I would like to switch the security layer of my API from Basic Auth over HTTPS + claims-based infrastructure (w/ claims populated in a delegatinghandler) to a more robust mechanism and support client ...
0
votes
1answer
26 views

JWT for email validation of an account

I am thinking of using the this registration flow for my site: 1) User registers by entering email and password. 2) Enter the email and hashed password into my database 3) I then construct an ...
2
votes
0answers
24 views

Can a service provider communicate directly with an identity provider?

I'm making an authentication server that will act as an identity provider for my service. Looking at the typical SAML use case, the service provider will redirect the principal to the identity ...
0
votes
0answers
14 views

RPC Service Authentication using Server and Client Nonce

Forgive my ignorance, security is not my field. I have a RPC server where the server keeps a protected file containing user names and corresponding passwords. I would like to securely authenticate ...
0
votes
0answers
61 views

Risks of having SSH private key stolen

I'm afraid this is quite a common question, but searching several times through the questions did not prove useful, and I'm really eager of knowledge here :D I understand that keeping SSH private key ...
5
votes
3answers
570 views

Is it secure not to have csrf protection in login forms?

I have noticed that WordPress doesn't have csrf protection for their admin panel login /wp-admin/. Does it actually posses any potential risk? Is there any possible ways there an attacker could ...
0
votes
1answer
45 views

How to authenticate users?

I'm in the scenario that I'm planning a detailed description on "how to securely encrypt files" without putting too much in one Q/A. So, in a file-encryption scenario, what are the possible ways to ...
0
votes
2answers
41 views

Does using a token and a pin for logging into a corporate internal system removes the need for using regular user names and passwords?

I am evaluating an internal 2 factor authentication implementation in an organization. The system designer wants to remove regular user names and passwords from all user workstations such that each ...
1
vote
2answers
40 views

Is there a PKCS certificate format that signs ASCII data?

Is there a PKCS #x already out there that was designed to sign ASCII data and protect it from manipulation? I was originally guided to PKCS #7, but based on posts here it looks like the data is not ...
0
votes
1answer
67 views

Is my JWT refresh plan secure?

I plan on using JWT for my login system for mobile devices. There is no real standard workflow for refreshing JWT tokens I could find so I created this one below. The reason I want to use JWT is for ...
0
votes
1answer
84 views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img ...
0
votes
0answers
65 views

Could other people steal my Internet connection if they had my PPPoE data?

Would it be possible for other people to use my PPPoE data to get Internet access or is it somehow restricted to my house? Then what about my neighbors downstairs, could they do it? And what about ...
2
votes
0answers
52 views

Ouath2 how does it work (Android client)

I have read a lot about Oauth2 but still cannot understand, how does it work. I will explain how do I understand this protocol. There are some main characters in Oauth protocol interaction. User, ...
1
vote
0answers
46 views

How to secure requests to my API from my web widget embedded in third party website

Background I'm designing a web widget for a new SaaS for embedding in a password-protected CMS. This would allow the customer to add something like the following to all the pages in their CMS to ...
0
votes
0answers
14 views

unable to download content from login page [migrated]

I am using apache tomcat on linux platform to host website. I put apk link on login page so users/guest can download mobile app but they are unable to download that app. When registered user login to ...
1
vote
0answers
34 views

What happens when authenticating through a phishing attack with FIDO U2F tokens

So I have looked around and haven't found this anywhere. What happens when the response server is a phishing site with FIDO U2F tokens? Basically, if login just fails, I would assume that the user ...
-1
votes
0answers
32 views

is Form Authentication more secure than using the session authentication?

Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication. For Example if somebody hacked my ...
1
vote
1answer
48 views

Login from a desktop application to a web application

I have a desktop application and a web application. The user is loged in on the desktop application. With a click on a button or something the browser should open and the user should be logged in. ...
4
votes
1answer
40 views

Can BTRFS provide authentication on an encrypted disk?

One of the problems of disk encryption is providing authentication. An attacker with access to the ciphertext can modify the ciphertext at will without consequence. Given, this isn't a likely attack, ...
0
votes
1answer
31 views

Should I stretch the secret key in a secure cookie protocol implementation?

I'm building an api authentication layer that basically works like the secure cookie protocol, where instead of a cookie I give the api client a token which they must provide on subsequent requests. ...
2
votes
2answers
61 views

Issuing secure tokens that doesn't require any server side state

The issue I am currently designing the backend for a SPA (Single Page Application), which I'm planning to construct in a fairly RESTful manner. The backend will ideally be just a thin layer between ...