Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
12 views

HMAC based algorithm for publicly sharing authenticated messages

I am trying to design an algorithm for publicly sharing authenticated messages. Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep ...
0
votes
1answer
16 views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
0
votes
0answers
9 views

How to evaluate authentication for a WAP portal?

I am trying to evaluate a security authentication for a WAP portal. The authentication works by asking the customer for his unique MSISDN and then a secret pin code is sms to client. In this is a ...
-8
votes
0answers
59 views

What are the best and most popular authentication algorithms/protocols? [on hold]

Our cryptographic/security company is designing a new generic versatile library that implements all popular algorithms in all areas of cryptography. Now I'm studying a subject of Authentication. What ...
0
votes
0answers
22 views

Security considerations for RESTlike HTTP API of an embedded system

I'm designing a HTTP service for an embedded device and wondering if the following security concept is good enough: SSL(Up to Version 3) is enabled by default, TLS is not by limitations of the ...
0
votes
1answer
46 views

Secure log in without sending plain test to server

I know this question asked so many times, but here I am again with it. I am working on an application in which I need to log-in users but the question is it is not a good Idea to send user credentials ...
1
vote
1answer
29 views

Authentication vs. Verification in General and with Biometrics

I am reading The Basics of Information Security, 2nd. Ed., Andress, Jason. He says on p.25, "Identity verification is a step beyond identification, but it is still a step short of authentication, ...
0
votes
0answers
30 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
2
votes
2answers
84 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
3
votes
1answer
80 views

Closely spaced failed logins in auth.log

I have a raspberry-pi (running GNU/Linux) and I recently allowed my router to forward port 22 (ssh) to the raspberry-pi so that I could log in while away from home. I then noticed a bunch of ...
0
votes
4answers
178 views

Security of a Random Password

i. If I choose random password of length say 15 from the alphabet set of size 94 i.e. from the search space of 94^15, is my password protected against all kind of threats? ii. Will there be any need ...
0
votes
1answer
20 views

Verification code generation and expiration

I am trying to implement an application that includes registration, In order to register to the system the user shall enter his organization ID number let's say. To verify the user identity, a ...
0
votes
0answers
22 views

What is the difference between session fixation and session recreation?

I have read that both of them are conventionally the same. But there must be a few differences which differentiates the two terms. Anyone please explain.
3
votes
2answers
92 views

One time passwords using Mobile phones [on hold]

It is safe to assume that the majority of users accessing the internet also possess the mobile phones. So can we take advantage of this and relieve users of remembering any passwords. Instead of ...
21
votes
3answers
3k views

What are the disadvantages of implementing HTTP authentication in a web application? [duplicate]

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
-1
votes
0answers
50 views

Request on port 843 to fnes.amazon.com only on the login page of amazon [closed]

I wonder if anybody knows why amazon, only on their login pages (both for amazon.com and for aws console login) does a request on port 843. This request is apearantly to name fnes.amazon.com My ...
-1
votes
0answers
19 views

Drawbacks of OpenVAS [closed]

Delibrate on any major vulnerability detection capability missing in OpenVAS compared to its commercial alternative solutions. Please.
-2
votes
0answers
15 views

DB vulnerability OpenVAS [closed]

Could anybody comment on the strength of OpenVAS for detecting DB vulnerability.
-4
votes
0answers
37 views

How to find Database attack in my site? [closed]

When i open my site admin i cant able to view the booking details.But booking is stored in Data Base.Is there any attack in my site? Yes means how can i find and solve it?
3
votes
1answer
79 views

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
0
votes
0answers
12 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
0
votes
1answer
68 views

Idea for an algorithm to authenticate users with zero-knowledge-proof [need thoughts/review]

I have an idea for an algorithm. I don't know if I made any mistakes and need some extra thoughts/peer review on it. This would work as an (almost)zero knowledge proof for sending passwords that can ...
1
vote
1answer
73 views

Authentication between two internal servers

I have two internal servers that are going to communicate with each other; they speak HTTP/TLS. Is there a best practice for authenticating communications between internal servers? Short of a best ...
0
votes
2answers
27 views

Ubuntu backup to only specific devices

I am looking into setting up a secure Ubuntu server with daily backups to two different external hard drives that will be swapped with the external hard drive that is stored in a safe deposit box. ...
-3
votes
0answers
29 views

What forms of two-factor authentication are used by the Healthcare industry? [closed]

I know fingerprint and usb tokens are used. Not sure if other schemes are used. Primarily hospitals and insurance providers.
2
votes
5answers
233 views

Can extra loading times on login attempts be a security threat?

I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password. Since I'm using the PHP native (slow) hashing ...
8
votes
1answer
906 views

Why would HTTP client only send authentication headers once an unauthenticated request was rejected?

The default usage of HttpClient and HttpWebRequest .NET classes is setting Credentials property and then asking the class instance to perform an HTTP request. If the target requres Basic authorization ...
1
vote
0answers
40 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
9
votes
4answers
211 views

What kind of factor is a physical signature?

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified: Is it ...
51
votes
10answers
11k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
3
votes
2answers
65 views

Link Layer authenticated encryption vs authentication

Many security articles discuss about adding an extra layer of security at the link layer by either authenticating the data at the link layer authenticating and encrypting it. If we have ...
1
vote
0answers
45 views

Does Ally Bank's trusted image system actually make login safer? [duplicate]

Ally Bank uses a 'trusted image' system to supposedly make login more secure. I can't find evidence that this is standard practice, so I'll explain it. When creating an account, you choose an image ...
2
votes
7answers
306 views

Is it wrong to root login with SSH?

I've long been under the impression that with unix, you should never login as root. Now I've started using Virtual Private Servers over at DigitalOcean, and some advice is to use SSH keys to login as ...
4
votes
2answers
139 views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
0
votes
0answers
12 views

Prevent Derby SQL User Authentication Change [migrated]

Can someone tell me if there exists SQL code for Derby to change a username or password of a database? How may I reproduce this to prevent it in future in my application? What I'm busy doing, is to ...
1
vote
3answers
159 views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
2
votes
1answer
91 views

How to autenticate properly in Java

I have to write some login module for Java EE application. Previously i was using JBoss security - provided login and password, called HttpServletRequest with login method and JBoss security did the ...
0
votes
0answers
36 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
1
vote
0answers
28 views

Using a bearer token to get a federation token from ADFS

Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token. Is there a specific ...
3
votes
3answers
103 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
1
vote
1answer
34 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
2
votes
1answer
76 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
1
vote
2answers
98 views

Which encryption technique should be used for cloud computing data transfer?

I want to setup my application for cloud computing for Software as a Service. There is going to be a lot of data transfer between my server and client, to and fro. The technique I have envisaged is: ...
1
vote
2answers
45 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
4
votes
4answers
127 views

Which one to ask first in multi-factor authentication?

Let's say I have a system which use something you know, like a password, and something you have, like a code sent to a cell phone, to authenticate. Is there a preferred order to ask for the password ...
1
vote
1answer
79 views

Shared Key vs Pre-Shared Key

Does Shared key and Pre-shared key mean different thing ? Currently reading Text , Security+ Guide to Network Security Fundamentals.
28
votes
4answers
2k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
2
votes
1answer
104 views

How can I protect my “try it with one click” service?

I have a service with "try it now" experience that currently offers a "one click" effort. This service has a pool of N resources (lets say 50). Each new resource takes about 1 hour to generate. ...
14
votes
6answers
966 views

Additional security benefits from Multi-Factor Authentication?

Does multi-factor authentication provide any additional security benefits on top of doing a better job at correctly identifying and authenticating users compared to single factor authentication? In ...
1
vote
1answer
52 views

Logging in users automatically on a website

I'm making a website that has an extended forum feature, where users can login, post comments, etc. I'm making the feature where the website stores cookies in your computer so the next time you visit ...